Attachment J-B Applicable Documents List.pdf

ATTACHMENT J-B

ENTERPRISE MULTIMEDIA AND

INTEGRATED TECHNICAL SERVICES

(eMITS) APPLICABLE DOCUMENTS LIST

RFP 80TECH22R0001

CONTRACT # TBD

DATE: May 2022 eMITS

J-B-2

NPD/NPR

NASA Policy Directives (NPD) and NASA Procedural Requirements (NPR)

Document Subject

NPD 1000.0 NASA Governance and Strategic Management Handbook

NPD 1000.5 Policy for NASA Acquisition

NPR 1040.1 NASA Continuity of Operations (COOP) Planning Procedural Requirements

NPD 1280.1 NASA Integrated Management System Policy

NPD 1380.1 Managing Agency Communications

NPR 1382.1 NASA Privacy Procedural Requirements

NPD 1382.17 NASA Privacy Policy

NPD 1383.1 Release and Management of Audiovisual Products

NPD 1383.2 NASA Assistance to Non-Government, Entertainment-Oriented Motion Picture, Television, Video & Multimedia Productions/Enterprises, & Advertising

NPD 1387.1 NASA Exhibits Program

NPD 1420.1 NASA Forms Management

NPD 1440.6 NASA Records Management

NPR 1441.1 NASA Records Management Program Requirements

NPR 1450.10 NASA Correspondence Management and Communications Standards and Style

NPD 1490.1 NASA Printing, Duplicating, and Copying Management

NPR 1600.1 NASA Security Program Procedural Requirements

NPR 1600.2 NASA Classified National Security Information (CNSI)

NPR 1620.3 Physical Security Requirements for NASA Facilities and Property

J-B-3

NPR 1800.1 NASA Occupational Health Program Procedures

NPD 2190.1 NASA Export Control Program

NPR 2190.1 NASA Export Control Program

NPR 2200.2

Requirements for Documentation, Approval and Dissemination of NASA Scientific and Technical Information (STI)

NPD 2521.1 Communications and Material Review

NPD 2540.1 Acceptable Use of Government Office Property Including Information Technology

NPD 2800.1 Managing Information Technology

NPR 2800.2 Information and Communication Technology Accessibility

NPD 2810.1 NASA Information Security Policy

NPR 2810.1 Security of Information and Information Systems

NPR 2810.2

Possession and Use of NASA Information and Information Systems Outside of the United States and United States Territories

NPD 2830.1 NASA Enterprise Architecture

NPR 2830.1 NASA Enterprise Architecture Procedures

NPR 2841.1 Identity, Credential, and Access Management

NPR 3792.1 NASA’s Plan for a Drug Free Workplace

NPR 4100.1 Supply Support and Material Management Policy

NPD 4200.1 Equipment Management Program

NPR 4200.1 NASA Equipment Management Procedural Requirements

NPR 4300.1 NASA Personal Property Disposal Procedural Requirements

NPR 4500.1 Administration of Property in the Custody of Contractors

J-B-4

NPD 6000.1 Transportation Management

NPR 6200.1 NASA Transportation and General Traffic Management

NPR 7120.5 NASA Space Flight Program and Project Management Requirements

NPR 7120.6 Knowledge Policy for Programs and Projects

NPR 7120.7 NASA Information Technology Program and Project Management Requirements

NPR 7120.8 NASA Research and Technology Program and Project Management Requirements

NPR 7123.1 NASA Systems Engineering Processes and Requirements

NPR 7150.2 NASA Software Engineering Requirements

NPR 7500.2 NASA Technology Transfer Requirements

NPR 8000.4 Agency Risk Management Procedural Requirements

NPR 8621.1 NASA Procedural Requirements for Mishap and Close Call Reporting, Investigating, and Recordkeeping

NPR 8715.1 NASA Safety and Health Programs

NPR 8715.3 NASA General Safety Program Requirements

NPD 8700.1 NASA Policy for Safety and Mission Success

NPD 8800.14 Policy for Real Estate Management

NPR 8831.2 Facilities Maintenance and Operations Management

NPR 9250.1 Property, Plant, and Equipment and Operating Materials and Supplies

NPR 9501.2 NASA Contractor Financial Management Reporting

NID

NASA Interim Directive (NID)

Document Subject

None

J-B-5

NRRS

NASA Records Retention Schedules (NRRS)

NRRS 1441.1 NASA Records Retention Schedule

ITS-HBK

IT Security Handbooks (ITS-HBK)

Document Subject

ITS-HBK-1382.02-01 Privacy Goals and Objectives: Overview

ITS-HBK-1382.03-01 Privacy Risk Management and Compliance: Collections, PIAs and SORNs

ITS-HBK-1382.03-02

Privacy Risk Management and Compliance: Annual Reporting Procedures for Reviewing and Reducing Personally Identifiable Information (PII) and Eliminating the Unnecessary Use of SSN

ITS-HBK-1382.04-01 Privacy and Information Security: Overview

ITS-HBK-1382.05-01 Privacy Incident Response and Management: Breach Response Team

ITS-HBK-1382.06-01

Privacy Notice and Redress: Web Privacy and Written Notice, Complaints, Access and Redress

ITS-HBK-1382.07-01 Privacy Awareness and Training: Overview

ITS-HBK-1382.08-01 Privacy Accountability

ITS-HBK-1382.09-01 Privacy Rules of Behavior and Consequences: Overview

J-B-6

IT Security Handbooks (ITS-HBK)

IT-HBK-1440.01.01 Records Planning & Management: Records Management and Records Life Cycle - Overview

IT-HBK-1441.01.01 Records Retention and Disposition: Overview

ITS-HBK-2810.02-01 Security Assessment and Authorization

ITS-HBK-2810.02-02

Security Assessment and Authorization: Information System Security Assessment and Authorization Process

ITS-HBK-2810.02-04

Security Assessment and Authorization: Continuous Monitoring – Security Control Ongoing Assessments and Authorization

ITS-HBK-2810.02-05

Security Assessment and Authorization: External Information Systems

ITS-HBK-2810.02-06

Security Assessment and Authorization: Extending and Information Systems Authorization to Operate Process and Template

ITS-HBK-2810.02-08

Security Assessment and Authorization: Plan of Action and Milestones

(POA&M)

J-B-7

ITS-HBK-2810.03-02

Planning

ITS-HBK-2810.04-01

Risk Assessment: Security Categorization, Risk Assessment, Vulnerability Scanning, Expedited Patching & Organizationally Defined Values

ITS-HBK-2810.05-02 Systems and Service Acquisition

ITS-HBK-2810.06-02 IT Security Awareness, Training, and Education

ITS-HBK-2810.07-02 Configuration Management

ITS-HBK-2810.08-01 Contingency Planning

ITS-HBK-2810.09-01 Incident Response and Management

ITS-HBK-2810.09-02 NASA Information Security Incident Management

ITS-HBK-2810.09-03 Collection of Electronic Data

ITS-HBK-2810.09-04

Incident Response and Management: Guidelines for Data Spillage & Sanitization Procedures

ITS-HBK-2810.10-02 Maintenance

J-B-8

ITS-HBK-2810.11-2 Media Protection and Sanitization

ITS-HBK-2810.12-02 Physical and Environmental Protection

ITS-HBK-2810.13-01 Personnel Security

ITS-HBK-2810.14-03 System and Information Integrity

ITS-HBK-2810.15-01 Access Control

ITS-HBK-2810.15-02 Access Control: Managed Elevated Privileges (EP)

ITS-HBK-2810.16-02 Audit and Accountability

ITS-HBK-2810.17-02 Identification and Authentication

ITS-HBK-2810.18-02 System and Communications Protection

ITS-HBK-2810.19.01 Operational Technology

ITS-HBK-2810.002-1 Format and Procedures for IT Security Policies and Handbooks: Privacy, Security & Sensitive Information

ITS-HBK-2841.003 Identity, Credential, and Access Management Services (ICAM)

IT-SOP-2810-2B Enterprise System Authorization To Operate (ATO) SOP

IT-SOP-2841-001.1 Identity and Credential Service Providers Federation Requests

IT-SOP-2841-002.1 Identity, Credential, and Access Management (ICAM) Services Deviation Requests

ITS-SOP-2810.02-01 Security Assessment and Authorization: OCIO ITSD Standard Operating Procedure (SOP): Internal Information Assurance Review

STD/Handbooks

Standards

Document Subject

NASA-STD-2804 Minimum Interoperability Software Suite

NASA-STD-2805 Minimum Hardware Configurations

J-B-9

NASA-STD-2818 Digital Television for NASA

NASA-STD-2821 Audio and Video Standards for Internet Resources

NASA-STD-2822 Still and Motion Imagery Metadata Standard

NASA/SP-2015-7062 NASA/SP-2015-7062

NASA/SP-7084

Grammar, Punctuation and Capitalization, a Handbook for Technical Writers and Editors

N/A U.S. Government Printing Office Style Manual

N/A Style Guide for NASA History Authors and Editors

N/A Stylebook and Communications Manual https://communications.nasa.gov/sites/all/sites/default/private/files/files/NAS A%20Stylebook%20Rev%209_1%20-%20September%202020.pdf

N/A NASA Graphics Standards Manual https://communications.nasa.gov/sites/all/sites/default/private/files/files/NAS A_GraphicsStandardsManual_Sept23_2021.pdf

N/A NASA Graphic Style Guide for Web and Social Media https://communications.nasa.gov/sites/all/sites/default/private/files/files/nasa-web-style-guide-draft-151118.pdf

J-10-10

EO/FIPS

Executive

Orders and

FIPS

Document Subject

Executive Order

(EO) 13556

Controlled Unclassified Information (CUI)

EO 13636 Improving Critical Infrastructure Cybersecurity

EO 13834 Efficient Federal Operations

EO 13693 Planning for Federal Sustainability in the Next Decade Federal Information Processing Standards

(FIPS) 140-2

Security Requirements For Cryptographic Modules

FIPS 199 Standards for Security Categorization of Federal Information and Information Systems

FIPS 200 Minimum Security Requirements for Federal Information and Information Systems

OMB

Office of Management and Budget (OMB)

Document Subject

OMB Circular A-

Managing Information as a Strategic Resource

OMB M-15-14

Management and Oversight of Federal Information Technology, Federal Information Technology Acquisition Reform Act (FITARA)

OMB M-19-17

Enabling Mission Delivery through Improved Identity, Credential, and Access Management

NIST

NIST

NIST SP 800-12 An Introduction to Information Security

NIST SP 800-100 Information Security Handbook: A Guide for Managers

NIST SP 800-137

Series

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

J-10-11

NIST SP 800-161

Supply Chain Risk Management Practices for Federal Information Systems and Organizations

NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems

NIST SP 800-181 Workforce Framework for Cybersecurity (NICE Framework)

NIST SP 800-30 Guide for Conducting Risk Assessments

NIST SP 800-34 Contingency Planning Guide for Federal Information Systems

NIST SP 800-37 Risk Management Framework for Information Systems and Organizations:

A System Life Cycle Approach for Security and Privacy

NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-53A Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans

NIST SP 800-55 Performance Measurement Guide for Information Technology Systems

NIST SP 800-60

Volume I

Guide for Mapping Types of Information and Information Systems to Security Categories

NIST SP 800-60

Volume II

Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices

NIST SP 800-61 Computer Security Incident Handling Guide

CFR

Code of Federal Regulations

14 CFR Part 1221 The NASA Seal and Other Devices, and the Congressional Space Medal of Honor

15 CFR Parts 730-

Export Administration Regulations (EAR)

16 CFR Part 312 Children's Online Privacy Protection Rule

22 CFR Parts 120-

International Traffic in Arms Regulations (ITAR)

29 CFR Part 1903 Inspections, Citations, and Proposed Penalties

29 CFR Part 1910 Department of Labor; Occupational Safety and Health Administration Standards for General Industry

29 CFR Part 1926 Department of Labor; Occupational Safety and Health Administration

J-10-12

Standards for Construction Industry 36 CFR Part 1194 Information and Communication Technology Standards and

Guidelines (Section 508) 36 CFR, Chapter XII, Subchapter B

National Archives and Records Administration, Subchapter B - Records Management

40 CFR Part 82.162 Certification by Owners of Recovery and Recycling Equipment

NAII

NASA Advisory Implementing Instructions

NAII 2190.1E NASA Export Control Program Operations Manual

Quality

Quality Management Requirements

Document Subject

ANSI/ISO/ASQ

Q9001-2015

Quality Management Systems – Requirements

OTHER

From To Subject Date

Office of the Chief Information Office Distribution

Annual Cybersecurity and Sensitive Unclassified Information Awareness Training

September 14, Chief Information Officer, Office of Procurement, and Office of Protective Services

Officials in Charge, Center Directors, CIOs, CISOs

Your Role in Protecting NASA: Ensuring No Use of Prohibited IT/Telecommunications Services or Equipment at NASA

August 26, 2020

NASA

Administrator NASA Workforce Web Site Modernization and Enhanced

Security Protocols May 15, 2019

Chief Information Officer Distribution Authorizing Officials and Authorizing

Official Designated Representatives February 27, Chief Information Distribution Use of Personally-Owned Mobile Devices October 25, 2018

J-10-13

Officer to Connect to NASA Email, Calendar and Contacts Services

Chief Information Officer

Officials-in- Charge of Headquarters Offices Directors, NASA Centers

Use of Unauthorized Devices April 16, 2018

Administrator

Officials-in- Charge of Headquarters Offices Directors, NASA Centers

Updated Guidance for Traveling Abroad with NASA IT Assets May 17, 2017

Administrator

Officials-in- Charge of Headquarters Offices Directors, NASA Centers

Managing Software in Support of NASA’s Mission May 5, 2017

Chief Information Officer Distribution NASA Federal Source Code Framework November 7, Chief Information Officer

Center Chief Information Officers, Associate CIO for Enterprise Services

Remediating Vulnerabilities in Unsupported or End of Life Software March 30, 2016

ACIO for Information Technology Security Division, ACIO for Enterprise Services and Integration Division

Distribution NASA Transport Layer Security (TLS) Implementation and Certificate Requirements

March 17, 2016