E-Library_NPR_2810_001F_.pdf

| NODIS Library | Legal Policies(2000s) | Search |

NASA

Procedural Requirements

NPR 2810.1F

Effective Date: January 03, 2022

Expiration Date: January 03, COMPLIANCE IS MANDATORY FOR NASA EMPLOYEES

Security of Information and Information Systems (Updated with Administrative edits, Change 1)

Responsible Office: Office of the Chief Information Officer

Table of Contents Preface

Change History P.1 Purpose P.2 Applicability P.3 Authority P.4 Applicable Documents and Forms P.5 Measurement/Verification P.6 Cancellation

Chapter 1. Introduction

1.1 Introduction

1.2 Roles and Responsibilities

Chapter 2. Identify Function

2.1 Asset Management

2.2 Business Environment

2.3 Governance

2.4 Risk Assessment

2.5 Risk Management Strategy

2.6 Supply Chain Risk Management

NPR 2810.1F -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- TOC Page 1 of 78

Chapter 3. Protect Function

3.1 Identity Management and Access Control

3.2 Awareness and Training

3.3 Data Security

3.4 Information Protection Processes and Procedures

3.5 Maintenance

3.6 Protective Technology

Chapter 4. Detect Function

4.1 Anomalies and Events

4.2 Security Continuous Monitoring

4.3 Detection Processes

Chapter 5. Respond Function

5.1 Response Planning

5.2 Communications

5.3 Analysis

5.4 Mitigation

5.5 Improvements

Chapter 6. Recover Function

6.1 Recovery Planning

6.2 Improvements

6.3 Communications

Appendix A Definitions Appendix B Acronyms Appendix C Requirements Matrices Appendix D References Appendix E Requirements Matrix with respect to system lifecycle

NPR 2810.1F -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- TOC Page 2 of 78

CHANGE HISTORY

Chg# Date Description

1 09/04/2024 Updated with administrative changes to align directive with the OCIO transformation process. The changes include:

revising the role of the Center Chief Information Security Officer (CISO) to reflect new responsibilities; Revised the NASA Security Operations Center (SOC) to reflect coordination, external coordination, and reporting; added a new definition to Appendix A. Operation Technology.

NPR 2810.1F --

ChangeHistory

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- ChangeHistory Page 3 of 78

Preface P.1 Purpose

a. This directive establishes the information security requirements for the NASA Information Security Program. The procedural requirements herein prescribe roles, responsibilities, and conditions that directly or indirectly promote information security throughout the life cycle of all NASA information and information systems, including operational technology systems.

b. This directive identifies information security policies, procedures, and practices that are related to NASA's mission, and consistent with federal laws, executive orders, directives, policies, and regulations.

c. This directive aligns roles and responsibilities of information technology (IT) security personnel to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Risk Management Framework (RMF) for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy and NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations.

d. This directive serves as a reference to the NASA community regarding specific information security roles and responsibilities, and it provides resources where more detailed information may be found.

e. This directive implements cybersecurity policy best practices and guidance, particularly those outlined by the NIST SP 800-171, Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations, NIST SP 800-37, NIST SP 800-46, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-60 Vol. 1, Guide for Mapping Types of Information and Information Systems to Security Categories, NIST SP 800-82, Guide to Industrial Control Systems (ICS) Security, NIST 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, NIST SP 800-160 Vol. 2, Developing Cyber Resilient Systems - A Systems Security Engineering Approach, and NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, referenced NASA policy documents, specifications, and standards, and mandated by Federal Information Processing Standards (FIPS) across all corporate, project, and mission elements (ground and flight systems).

P.2 Applicability

a. This directive applies to NASA Headquarters and all NASA Centers, including Component Facilities and Technical and Service Support Centers.

(1) For purposes of this directive, NASA Headquarters is treated as a Center. Further, all roles and responsibilities of a Center Chief Information Officer (CIO) apply to NASA Headquarters CIO and all stipulated Center requirements apply to NASA Headquarters.

b. This directive applies to contractors, recipients of grants, cooperative agreements, or other agreements only to the extent specified or referenced in the contracts, grants, or agreements.

NPR 2810.1F -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Preface Page 4 of 78

c. This directive applies to all unclassified NASA information and NASA information systems, including those that are contracted out, outsourced to, or operated by:

(1) Government owned, contractor operated (GOCO) facilities;

(2) partners under the Space Act;

(3) partners under the Commercial Space Act of 1997;

(4) partners under cooperative agreements; or

(5) commercial or university facilities.

d. This directive does not apply to information systems that do not process NASA information, and are merely incidental to a contract (e.g., a contractor's payroll and personnel management system).

(1) In this directive, all mandatory actions (i.e., requirements) are denoted by statements containing the term "shall." The terms: "may" or "can" denote discretionary privilege or permission, "should" denotes a good practice and is recommended, but not required, "will" denotes expected outcome, and "are/is" denotes descriptive material.

e. This directive does not apply to Classified National Security Information (CNSI). CNSI is the responsibility of the Office of Protective Services (OPS) and is covered under CNSI policy and requirements contained in NASA Procedural Requirement (NPR) 1600.2, NASA Classified National Security Information (CNSI) and NPR 1600.1, NASA Security Program Procedural Requirements.

f. This directive applies to all NASA users of information systems (e.g., civil servants and contractors) when supporting Agency projects, programs, and missions.

g. In this directive all document citations are assumed to be the latest version unless otherwise noted.

P.3 Authority

a. Freedom of Information Act, 5 U.S.C. § 552, et seq.

b. Privacy Act of 1974, 5 U.S.C. § 552a.

c. Violation of Regulations of National Aeronautics and Space Administration, 18 U.S.C. § 799.

d. Inspector General Act of 1978, 5 U.S.C. App. III.

e. Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2510, et seq.

f. Clinger-Cohen Act of 1996, 40 U.S.C. § 11101 et seq.

g. Federal Information Technology Acquisition Reform Act (FITARA) of 2014, 40 U.S.C. § 11319 et seq.

h. E-Government Act of 2002, 44 U.S.C. § 101.

i. Paperwork Reduction Act of 1995, 44 U.S.C. § 3501, et seq.

j. Federal Information Security Management Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq.

NPR 2810.1F -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Preface Page 5 of 78

k. Export Control Reform Act of 2018, 50 U.S.C. 4801-4852.

l. National Aeronautics and Space Act, 51 U.S.C. § 20113(e).

m. Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, E.O. 13800, 82

FR 22391 (2017).

n. Availability of Agency Records to Members of the Public, 14 Code of Federal Regulations (CFR)

pt. 1206.

o. Export Administration Regulations, 15 CFR pts. 730-774.

p. International Traffic in Arms Regulations, 22 CFR pts. 120-130.

q. National Telecommunications and Information System Security (NTISS) 1, National Policy on Application of Communications Security to U.S. Civil and Commercial Space Systems, June 17, 1982.

r. NTISS 100, National Policy on Application of Communications Security to Command Destruct Systems, February 17, 1988.

s. Homeland Security Presidential Directive 7 (HSPD-7), Critical Infrastructure Identification, Prioritization, and Protection, December 2003.

t. HSPD-12, Policies for a Common Identification Standard for Federal Employees and Contractors, August 2004.

u. HSPD-20, National Continuity Policy.

v. GAO-09-232G, Federal Information System Controls Audit Manual (FISCAM).

P.4 Applicable Documents and Forms

a. NASA Federal Acquisition Regulations (FAR) Supplement, 48 CFR Chapter 18.

b. NPD 1000.0, NASA Governance and Strategic Management Handbook

c. NPD 1000.3, The NASA Organization

d. NPD 2540.1, Personal Use of Government Office Equipment Including Information Technology.

e. NPD 2810.1, NASA Information Security Policy.

f. NASA Records Retention Schedule No 1441.1 (updated) May 18, 2020.

g. NPR 1600.1, NASA Security Program Procedural Requirements.

h. NPR 1600.2, NASA Classified National Security Information (CNSI).

i. NPR 2841.1, Identity, Credential, and Access Management.

j. NPR 4200.1, NASA Equipment Management Procedural Requirements.

k. NPR 8000.4, Agency Risk Management Procedural Requirements.

NPR 2810.1F -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Preface Page 6 of 78

l. NASA Advisory Implementing Instruction (NAII) 1050.3, NASA Partnership Guide.

m. NASA-STD-1006, Space System Protection Standard.

n. NASA-SPEC-2600, Enumeration of ASCS Cybersecurity Requirements.

o. NASA-SPEC-2650, TLS Security Configuration Specification.

p. NASA-SPEC-2607.WEB, Web Server Infrastructure Security.

q. NIST (SP) 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

r. NIST SP 800-171, Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations.

s. NIST SP 800-46, Guide to Enterprise Telework Remote Access, and Bring Your Own Device (BYOD) Security.

t. NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations.

u. NIST SP 800-60, Volumes 1 and 2, Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices.

v. NIST SP 800-82, Guide to Operational Technology (OT) Security.

w. NIST SP 800-160 Vol. 2, Developing Cyber Resilient Systems - A Systems Security Engineering Approach.

x. NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.

y. ITS-HBK-2810.11-2 Media Protection and Sanitization.

z. Department of Homeland Security (DHS) Binding Operational Directive (BOD) 18-02 Securing High Value Assets.

P.5 Measurement/Verification

a. Federal regulatory and NASA requirements drive the obligation to measure performance and reduce cost. These measurements will be based upon NASA's goals and objectives and be designed to provide substantive justification for decision-making. The measures will be used to measure the effectiveness of the information security program, policies, and requirements.

b. The NIST Cybersecurity Framework is the fundamental basis of such measurement.

c. The Senior Agency Information Security Officer (SAISO) will provide assessments or audit of the application of this directive. Assessments and audits will consist of reporting from the Centers, including information collected for the satisfaction of Office of Management and Budget (OMB) and FISMA reporting requirements.

d. All covered entities are subject to information security compliance reviews and audits by NASA.

NPR 2810.1F -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Preface Page 7 of 78

P.6 Cancellation NPR 2810.1A, Security of Information Technology, dated May 16, 2006.

NPR 2810.1F -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Preface Page 8 of 78

STUFF

Chapter 1. Introduction

1.1 Introduction

1.1.1 Structure

1.1.1.1 This directive establishes the information security requirements and responsibilities for NASA, relative to the policy set forth in NPD 2810.1, NASA Information Security Policy. This directive does not negate any existing policies, procedures, memos, handbooks, etc., except where explicitly stated in section P.6 Cancellation. This document is intended to provide a framework for information security and serve as an avenue for the authorization of more in-depth documents (e.g., handbooks, memoranda).

1.1.1.2 This directive is organized into six chapters: (1) Introduction; (2) Identify; (3) Protect; (4) Detect; (5) Respond; and (6) Recover.

a. The chapters in this directive align to the functional areas of the NIST Cybersecurity Framework

(CSF).

b. Each chapter defines the overall intent of the functional area and the roles and responsibilities specific to the area. Each chapter provides references to where more detailed requirements, procedures, and information may be found.

1.1.2 Approach

1.1.2.1 NASA's SAISO establishes the Agency's Cybersecurity and Privacy Program and its overall objectives and priorities. NASA Headquarters, Centers, satellite facilities, and support service contractor sites have the latitude to use their internal organizational structure to fulfill the roles and responsibilities described herein if the approach is consistent with this directive and more in-depth policy documents authorized by this directive.

1.1.2.2 NASA's approach to information security is grounded in risk management. Just as a solid understanding of risk management principles is essential to the success of NASA's space and aeronautics Missions, a solid understanding of these principles is essential to the protection of NASA information and information systems.

1.1.3 Legal Framework

1.1.3.1 Existing laws, regulations, and guidance govern NASA's implementation of an information security program.

a. The primary statute governing information security is FISMA, which defines information security as the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

b. This directive establishes how NASA implements the requirements of FISMA as they relate to NASA information and information systems.

c. The Clinger-Cohen Act states that the NIST FIPS are "compulsory and binding" 40 U.S.C. §

NPR 2810.1F -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter1 Page 9 of 78

11331(b)(1)(C). FISMA also advocates that information security be based on "periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency," Federal Agency Responsibilities, 44 U.S.C. § 3554(b)(1).

FISMA provides flexibility regarding the application of information security controls.

1.1.3.2 To implement federal and NASA policies and requirements, FISMA allows for the delegation of responsibilities into various functional roles.

1.2 Roles and Responsibilities

1.2.1 Overview

1.2.1.1 The following are overarching roles and responsibilities related to the NASA Cybersecurity and Privacy Program. Specific roles and responsibilities, as related to information security controls, are referenced throughout the remainder of this directive in their respective chapters. Additional responsibilities may be defined in in-depth policy documents authorized by this directive.

1.2.1.2 Throughout this document roles and responsibilities are generally listed at the highest level possible, with the operating assumption that specific tasks and functions may be delegated as necessary unless explicitly prohibited.

1.2.1.3 For the Jet Propulsion Laboratory (JPL), the Agency CIO will designate the roles allocated for the United States federal government employees.

1.2.2 NASA Management Roles

1.2.2.1 The roles and responsibilities of NASA management are defined in NPD 1000.0, NASA Governance and Strategic Management Handbook, and further outlined in NPD 1000.3, The NASA Organization. The key roles and responsibilities specific to information security are summarized as follows:

1.2.2.2 The NASA Administrator shall:

a. Ensure the security of NASA's information and information systems.

b. Ensure that NASA implements the NIST Cybersecurity Framework.

1.2.2.3 The NASA CIO provides leadership, planning, policy direction, and oversight for the management of NASA information and information systems. The NASA CIO shall:

a. Ensure confidentiality, integrity, and availability of all NASA's information assets throughout the system life cycle.

b. Ensure all NASA IT is in compliance with federal and NASA Cybersecurity and Privacy Program requirements.

c. Commission suitable governance bodies.

d. Evaluate and approve, disapprove, or rescind the designation of Authorizing Officials (AO).

e. Advise senior NASA officials concerning their information security responsibilities.

f. Ensure the NASA enterprise architecture integrates information security considerations into the

NPR 2810.1F -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter1 Page 10 of 78 strategic, capital, and investment planning process.

g. Encourage the maximum reuse and sharing of information security-related information throughout the NASA community.

h. Develop, implement, and maintain a Controlled Unclassified Information (CUI) program which is managed in accordance with Executive Order (E.O.) 13556, Controlled Unclassified Information, and Controlled Unclassified Information, 32 CFR, pt. 2002.

i. Be an employee of the United States Federal Government.

1.2.2.4 Officials in charge of Mission Directorates and Mission Support Offices shall:

a. Appoint an information security point of contact to represent the mission on Agency programmatic strategic cybersecurity initiatives and serve as a voting member of suitable governance bodies.

b. Ensure that resources are allocated to address information and information system security requirements developed under this directive for their information systems.

c. Ensure that their respective organizations, including missions, programs, projects, and institutions under their purview, comply with this directive, ensuring Operational Technology is also compliant.

d. Ensure that secure software development is being practiced for NASA projects per NPR 7150.2, NASA Software Engineering Requirements.

e. Ensure that secure system development is being practiced for NASA projects per NASA specifications and standards, including NASA-STD-1006, and the NASA Cybersecurity Requirements Technical Specification.

1.2.2.5 The Center Directors and the Director for Headquarters Operations shall:

a. With concurrence from the SAISO and the Center's CIO, designate a Center Chief Information Security Officer (CISO) in writing.

b. Ensure the Center CISO has adequate staff, resources, budget, and authority to implement information security programs at their Center.

1.2.3 Information Security Roles

1.2.3.1 In addition, the following offices and roles support the development and execution of information security policy are listed in the following paragraph.

1.2.3.2 A Center CIO shall:

a. If they apply, execute the responsibilities, comparable to those of the NASA CIO, at the Center level.

b. Execute the responsibilities, comparable to those of the NASA CIO, with respect to NASA facilities and systems not located at a Center as designated by the NASA CIO.

c. If the Center CIO assigns an Organizational Computer Security Official (OCSO) per section 1.2.3.3, designate Center-specific OCSO responsibilities, and any necessary interfaces with the Center CISO, in a Center-level formal policy.

NPR 2810.1F -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter1 Page 11 of 78

d. Be an employee of the United States Federal Government.

1.2.3.3 A Center CIO may optionally assign OCSOs to facilitate the implementation and oversight of information security within their organization.

1.2.3.4 The SAISO shall:

a. Carry out the responsibilities delegated from the NASA CIO under FISMA (as provided for by 44 U.S.C § 3554(a)(3)(A)), as well as federal and NASA cybersecurity and privacy program requirements.

b. Establish and maintain an office with the mission and resources to ensure compliance with federal and NASA Cybersecurity and Privacy Program requirements, including compliance with DHS BODs, Emergency Directives (EDs) as well as the DHS Continuous Diagnostics and Mitigation (CDM) Program.

c. Manage the NASA Cybersecurity and Privacy Program.

d. Keep the NASA Cybersecurity and Privacy Program current with changes in the information security environment and with changes in federal policy and guidelines.

e. Ensure that information security control assessments, authorizations, and OMB and FISMA reporting directives are completed across the Agency in a timely and cost-effective manner.

f. Select Center Chief Information Security Officers (CISOs) and Cybersecurity Risk Managers (CSRMs).

g. Serve as the NASA CIO's primary liaison with Center CISOs, AOs, Information System Owners (ISOs), and Information System Security Officers (ISSOs).

h. Oversee and arbitrate conflict resolution, relative to information security concerns, for all NASA-wide information systems.

i. Ensure the planning of a framework for the use and adoption of current and new information security technologies implemented throughout the Agency.

j. Maintain a process for planning, implementing, evaluating, and documenting remedial actions to address deficiencies and weaknesses in NASA's Cybersecurity and Privacy Program.

k. Manage the NASA system of Record for all Assessment and Authorization artifacts, including all System Security Plans. The current System of Record is Risk Information Security Compliance System (RISCS).

l. Develop, implement and manage a High Value Asset (HVA) program in accordance with Department of Homeland Security (DHS) Binding Operational Directive (BOD) 18-02 Securing High Value Assets.

m. Develop, implement and manage a threat monitoring and incident response program, to include the NASA Security Operations Center, for NASA HVAs in accordance with DHS BOD 18-02.

n. Be an employee of the United States Federal Government.

1.2.3.5 A Center CISO shall enforce the Cybersecurity and Privacy Program at the Center level.

1.2.3.6 An OCSO (if assigned per section 1.2.3.3) shall:

NPR 2810.1F -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter1 Page 12 of 78

a. Ensure compliance with information security requirements.

b. Serve as their organization's representative to the Center CISO on information security matters.

c. Report the status of the organization's information security to the Center CISO and senior organization officials.

d. Be an employee of the United States Federal Government.

1.2.3.7 The Cybersecurity Risk Manager (CSRM) shall:

a. Support the NASA cybersecurity Risk Executive function, as defined by NIST SP 800-37.

b. Serve as a cybersecurity risk management resource and as a subject matter expert on assessment and authorization.

c. Provide oversight for the cybersecurity risk management activities carried out by Center, service line, and mission organizations to help ensure consistent and effective risk-based decisions, in accordance with NASA policies, procedures and organizational risk tolerance.

d. Be an employee of the United States Federal Government.

1.2.3.8 An AO shall:

a. Formally assume the responsibility for the operation of an information system or for the use of a designated set of common controls at an acceptable level of risk to the system, mission, and/or Agency.

b. Allocate sufficient resources to adequately protect information and information systems based on an assessment of organizational risks.

c. Assign Authorizing Official Designated Representatives (AODRs), as necessary. Once designated, an AO may not further delegate their risk acceptance role as AO. However, AOs are encouraged to assign AODRs to support AO visibility into, and management of, their information systems' cybersecurity posture.

d. Be an employee of the United States Federal Government.

1.2.3.9 An AODR shall:

a. Execute the responsibilities of the AO as delegated.

b. Be an employee of the United States Federal Government.

1.2.3.10 An ISO shall:

a. Acquire, develop, integrate, operate, modify, maintain, and dispose of information systems.

b. Ensure system-level implementation of all Agency and Center requirements.

c. Ensure information systems are categorized in a manner that reflects the criticality of their function, and the sensitivity of the information they generate, collect, process, store, or disseminate.

d. Allocate resources to protect information and information systems based on an assessment of system risks.

NPR 2810.1F -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter1 Page 13 of 78

e. Ensure that information security controls are implemented according to a thorough risk-based analysis of their information systems' security postures.

f. Provide necessary assessment documentation, as required.

g. Take proper actions to identify, and minimize or eliminate, information system security deficiencies and weaknesses.

h. Communicate feedback to the Center CISO, OCSO (if assigned per section 1.2.3.3), and AO regarding the impact of Agency and Center-wide information security requirements on the operation of their information systems.

i. Ensure funding requests for information security requirements are included in annual budgeting submissions.

j. Utilize, to the extent possible, Agency-provided information system infrastructure.

k. Ensure that custom software developed for use on NASA information systems is implemented securely, in a manner that that reflects the criticality of its function, and the sensitivity of the information it generates, collects, processes, stores, or disseminates.

l. For a given program or project, develop a clear description of the information and system that is protected and evaluate the scope of information security resources that may be required for the project.

m. Appoint an Information Systems Security Officer (ISSO) to carry out provisions listed in 1.2.3.13.

1.2.3.11 Program Managers and Project Managers shall:

a. Allocate resources to protect information and information systems under their control based on an assessment of system risks.

b. Ensure identified cybersecurity risks accepted by AOs are also reflected in the program or project risk database(s)/system(s).

c. Include cybersecurity as part of the program and project plans for projects (e.g., incorporate the requirements of all applicable cybersecurity standards and specifications).

d. Identify and coordinate with ISOs for information systems under their control ensuring greater integration of cybersecurity and mission personnel.

e. Identify and coordinate with ISOs for information systems outside their control that support and impact their mission.

f. Ensure that all information systems under Program Managers' and Project Managers' control are fully compliant with the requirements of this directive.

1.2.3.12 An Information Owner (IO) shall:

a. Exercise statutory or operational authority for specified information.

b. Ensure the selection of information security controls is adequate for the protection of information under their authority during generation, collection, processing, dissemination, and disposal.

NPR 2810.1F -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter1 Page 14 of 78

1.2.3.13 An Information System Security Officer (ISSO) shall:

a. Serve as the principal advisor to the ISO on issues regarding information security.

b. Ensure a proper operational security posture is maintained for their information system.

c. Be responsible for the day-to-day security operations of their information system.

1.2.3.14 Contracting Officers, as defined in Federal Acquisition Regulation 2.101, or Agreement Managers as defined in NAII 1050.3, NASA Partnership Guide, shall ensure that the requirements of this directive are included and in scope for all NASA contracts, Space Act agreements, cooperative agreements, partnership agreements, or other agreements pursuant to which NASA data is being processed and transmitted; IT devices are procured for a purpose that is not incidental to the contract, and/or IT devices are developed or used on a NASA network.

NPR 2810.1F -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter1 Page 15 of 78

Chapter 2. Identify Function

2.1 Asset Management

2.1.1 Overview

2.1.1.1 Section 2.1 establishes requirements and processes to identify and manage data, devices, systems, and facilities relative to NASA's information security objectives and risk profile and risk posture.

2.1.2 Asset Management

2.1.2.1 The NASA SAISO shall ensure the maintenance of a NASA-wide information system inventory in the NASA system of record (i.e., RISCS).

2.1.2.2 An ISO shall:

a. Ensure that information system components are identified and documented.

b. Maintain, in the NASA system of record (i.e., RISCS), an accurate, up-to-date inventory of data, devices, systems, and facilities under their ownership monthly.

c. Provide such inventory to the Office of the Chief Information Officer (OCIO) in such manner and format that the SAISO determines.

2.1.3 Physical and Virtual Device and System Inventory

2.1.3.1 The NASA SAISO shall ensure the inventory required by section 2.1.2.1 is accurate and updated with all physical and virtual devices and systems.

2.1.3.2 An ISO shall:

a. Ensure the inventory required by section 2.1.2.1 includes all physical and virtual devices and systems.

b. Provide the NASA SAISO with such inventory.

2.1.4 Software Platform and Application Inventory

2.1.4.1 The NASA SAISO shall ensure the inventory required by section 2.1.2.1 is accurate and updated with all software platforms and applications.

2.1.4.2 The ISO shall:

a. Ensure the inventory required by section 2.1.2.1 includes all software platforms and applications.

b. Provide the NASA SAISO with such inventory.

2.1.5 System Interconnections

2.1.5.1 The NASA SAISO shall maintain the mapping of information system communications and data flows in the NASA system of record.

NPR 2810.1F -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter2 Page 16 of 78

2.1.5.2 The ISO shall:

a. Maintain and update documentation regarding system interconnections.

b. Provide the NASA SAISO with a mapping of information system communications and data flows.

c. Develop Memoranda of Agreements (MOA), Memoranda of Understandings (MOU), and Interconnection Security Agreements (ISA) for their systems.

d. Review and update such MOAs, MOUs, and ISAs annually.

2.1.6 External Information Systems Catalog

2.1.6.1 The NASA SAISO shall ensure the inventory required by section 2.1.2.1 is accurate and updated with all external information systems.

2.1.6.2 An ISO shall provide the NASA SAISO, in the NASA system of record (i.e., RISCS), with an inventory of external information systems under their supervision.

2.1.7 Resource Prioritization Policy

2.1.7.1 The SAISO shall consider the value of information and information systems to NASA's mission in the prioritization of information security effort and resources.

2.1.8 Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established in this section.

2.1.8.1 The NASA CIO shall:

a. Develop and maintain a NASA-wide Cybersecurity and Privacy Program.

b. Designate a SAISO.

2.1.8.2 The SAISO shall:

a. Manage the NASA Cybersecurity and Privacy Program.

b. Maintain and update, as needed to comply with federal and NASA requirements, NPD 2810.1, NPR 2810.1, and all related handbooks.

c. Publish and maintain such policies, procedures, NASA Information Technology Requirements (NITRs), specifications, standards, handbooks, and memoranda as may be necessary to implement the requirements of this directive.

2.2 Business Environment

2.2.1 Overview

2.2.1.1 This section establishes requirements to inform NASA's information security roles, responsibilities, and risk management decisions.

2.2.2 Supply Chain and Critical Infrastructure Identification

2.2.2.1 The NASA CIO shall:

NPR 2810.1F -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter2 Page 17 of 78

a. Work with internal and external stakeholders to identify and communicate NASA's role in the supply chain in order to inform the Supply Chain Risk Management (SCRM) requirements of section 2.6 of this document.

b. Work with internal and external stakeholders to identify and communicate NASA's role in critical infrastructure.

2.2.3 Contingency Planning

2.2.3.1 The head of Center Protective Services and the Center CIO shall coordinate Center-wide contingency planning efforts that provide for notification, activation, response, recovery, and reconstitution of a Center's information systems as a result of damage or disruption caused by a man-made or natural disaster.

2.2.3.2 The SAISO shall:

a. Develop and maintain Agency-level information system contingency planning policies, procedures, and guidance for NASA, as coordinated through OPS.

b. Develop and test information security contingency plans in place to continue fulfilling the business functions of NASA in support of the Agency's mission essential functions.

c. Establish recovery metrics and objectives for information systems.

2.2.3.3 The Center CISO, in coordination with OPS, shall:

a. Confirm implementation of those information system contingency planning procedures that provide for notification, activation, response, recovery, and reconstitution.

b. Support information system contingency plan tests, training, and exercises if needed.

2.2.3.4 The ISO shall:

a. Develop, test, implement, and maintain information system contingency plans.

b. Document assessment, recovery, and restoration procedures.

c. Ensure that the contingency plan documentation is maintained in a ready state and accurately reflects system requirements, procedures, organizational structure, and policies.

d. Ensure that recovery and restoration procedures outlined in information system contingency plans satisfy a risk-based analysis of the business needs and objectives of the information system and Agency at large.

e. Ensure that information system contingency plan documentation is at a level sufficient to permit a coordinated response at the Center and/or the Agency level.

f. Test, evaluate, and document contingency plans for accuracy, completeness, and effectiveness via a periodic test, training, and exercise program at a frequency in accordance with Agency Defined Values.

2.3 Governance

NPR 2810.1F -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter2 Page 18 of 78

2.3.1 Overview

2.3.1.1 This section establishes the requirements to develop policies, procedures, and processes to manage and monitor NASA's regulatory, legal, and risk environment and operations relating to information security.

2.3.1.2 The tenets and framework of NASA's Cybersecurity and Privacy Program are spelled out in this directive and related handbooks, and the Cybersecurity and Privacy Program Plan. The policies, procedures, milestones, metrics, and responsibilities of the Cybersecurity and Privacy Program together make up the Cybersecurity and Privacy Program Plan.

2.3.2 Cybersecurity Policy

2.3.2.1 The SAISO shall:

a. Develop and document a NASA-wide NASA Cybersecurity and Privacy Program that includes an overview and descriptions of measures of performance, enterprise information security architecture, critical infrastructure, risk management strategy, and an information security assessment and authorization process.

b. Provision a NASA-wide repository for information security documentation.

c. Review, update, and augment the NASA Cybersecurity and Privacy Program.

d. Ensure that the NASA Cybersecurity and Privacy Program plan, policy, and requirements are implemented.

e. Update and disseminate Organization Defined Values via a cybersecurity specification updated at least annually.

f. Define a process for the development, documentation, and maintenance of plans of action and milestones (POA&M) and for the acceptance of risk.

g. With respect to unclassified information systems, be responsible for ensuring NASA's implementation of the NIST RMF.

2.3.2.2 The ISO shall maintain information security documentation in the NASA-wide information security document repository required by section 2.3.2.1b.

2.3.3 Coordination of Information Security

2.3.3.1 The SAISO shall:

a. Coordinate information security compliance with internal and external resources across the Agency.

b. Coordinate information security reviews with the NASA Office of the Inspector General (OIG) and other external entities such as the U.S. Government Accountability Office (GAO).

c. Work with the NASA Office of Procurement to oversee the development and maintenance of an information security clause and coordinate implementation with NASA Office of Procurement as provided in the NASA Federal Acquisition Regulations (FAR), 48 CFR Ch. 18.

2.3.3.2 The Assistant Administrator of Procurement shall:

NPR 2810.1F -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter2 Page 19 of 78

a. Ensure that contracting officials are aware of requirements related to information security.

b. Ensure the inclusion of information security requirements in all contracts and solicitations.

2.3.3.3 Program Managers and Project Managers shall:

a. Ensure that projects or programs under their control implement the requirements of this directive.

b. Ensure that information security is incorporated into the planning and development of all information systems under their control by following the procedures outlined in NIST SP 800-160, Systems Security Engineering: Consideration for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems.

2.3.4 Management of legal and regulatory requirements

2.3.4.1 The SAISO shall:

a. Comply with OMB and FISMA reporting requirements.

b. Fulfill OMB and FISMA contingency plan testing requirements.

2.3.5 Governance and Management Processes

2.3.5.1 The NASA CIO shall report to OMB on the status of NASA's Cybersecurity and Privacy Program.

2.3.5.2 The SAISO shall:

a. Report to the NASA Administrator on the effectiveness of NASA's Cybersecurity and Privacy Program, including the progress of remedial actions, as required by FISMA.

b. Include information security resource requirements in programming and budgeting documentation.

2.3.5.3 The ISO shall:

a. Develop and maintain a System Security Plan (SSP) for their information systems.

b. Ensure that all SSPs are developed and tailored to address the threats and associated risks faced by the system.

c. Ensure that required system and services acquisition policy and procedures are implemented for their information systems and documented in the associated SSPs.

d. Establish system-level rules of behavior.

e. Assist in the development of information security requirements for inclusion in solicitations and resulting contracts for acquisitions made in support of their information.

2.3.5.4 The ISSO shall assist in the development of information security requirements for inclusion in solicitations and resulting contracts for acquisitions made in support of their information systems.

2.4 Risk Assessment

2.4.1 Overview

NPR 2810.1F -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter2 Page 20 of 78

2.4.1.1 This section establishes requirements for the assessment of cybersecurity risk to NASA's operations, assets, and individuals.

2.4.2 Risk Assessment Policy

2.4.2.1 The SAISO shall:

a. Identify and manage common cybersecurity threats to NASA.

b. Consistent with NPR 8000.4, Agency Risk Management Procedural Requirements, define and make available an RMF that describes a uniform methodology for risk assessment for all Agency internal and external systems.

c. Ensure the assessment, updating, and dissemination of information regarding Agency Common Controls.

d. Ensure the assessment, updating, and dissemination of information regarding those portions of Hybrid Controls that the Agency implements.

e. Manage the NASA-wide information security performance metrics program.

f. Work with the Information Sharing and Analysis Centers (ISACs) and other relevant information sharing fora.

2.4.2.2 The Center CISO shall understand and communicate with the AO, the ISO, the ISSO, other Center CISOs, CSRMs, and the SAISO any locally identified cybersecurity flaws associated with any information system.

2.4.2.3 The OCSO (if assigned per section 1.2.3.3) shall:

a. Verify the correct application of information system categorization criteria and requirements for their organization.

b. Ensure the identification and management of common threats to their organization.

2.4.2.4 The AO shall:

a. Authorize to operate only systems posing an acceptable level of risk to Agency assets, data, and personnel for production operation.

b. Ensure that all systems undergo a complete system security assessment prior to granting an initial Authorization to Operate (ATO).

c. Approve or reject information system categorizations.

d. Grant or deny systems ATO based on an evaluation of risk to the security posture of their information systems.

e. Plan and assign resources for information security assessment and authorization activities.

2.4.2.5 The ISO shall:

a. Assess information systems for risk in accordance with Agency policy and procedures.

b. Create POA&Ms or provide a documented AO acceptance of risk related to any identified system

NPR 2810.1F -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 2810.1F -- Chapter2 Page 21 of 78 information security deficiencies or weaknesses.

c. Complete POA&M tasks.

d. Apply resources towards the mitigation of identified risks to minimize threats to system performance.

e. Ensure that systems that are identified as posing unacceptable risk to other Agency operations or resources are communicated to the Center CISO and AO and mitigated in a manner that ensures the protection of Agency assets, data, and personnel.

f. Inform key officials of pending assessment and authorization activities.

g. Plan and advocate for the availability of resources for assessment and authorization activities.

h. Perform an information system risk analysis for their systems that can be used to support development of Agency information security baselines.

i. Seek an authorization from the AO prior to the operation of an information system and if changes to the system or its operating environment warrant a reauthorization.

2.4.2.6 The ISSO shall:

a. Perform information system risk analyses in support of security control selection and tailoring, security control implementation including system configuration, and continuous monitoring.

b. In collaboration with the ISO and IO(s), perform the information system security categorization, ensuring that the selected data types reflect all information generated, collected, processed and disseminated by the information system.

2.4.2.7 Program Managers and Project Managers shall:

a. With the support ISOs and ISSOs, understand and communicate to AOs any cybersecurity risks associated with any information system in a program or project under their control so that an assessment can be made of cybersecurity risk to Agency operations and resources.

b. Verify the proper application of information system categorization criteria and requirements for the programs and projects under their control.

2.5 Risk Management Strategy

2.5.1 Overview

2.5.1.1 This section establishes requirements for a cybersecurity risk management strategy to work in conjunction with requirements of NPR 8000.4.

2.5.2 Risk Management Strategy

2.5.2.1 The SAISO shall: a. Develop and implement a Cybersecurity Risk Management Strategy, which includes: definition of NASA's risk management priorities and constraints for NASA high-value assets, and mission and institutional systems; documentation criteria as a basis for determination of NASA's risk tolerances and assumptions; description of the importance of accurate and timely assessment of the likelihood and consequence severity of threats to NASA's critical infrastructure within the unique threat environment for NASA operations.

NPR 2810.1F -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a…