ENCLOSURE 4 - IT Security Management Plan Template.pdf
PDF 2 MB Posted
- Attached to
- Space and Earth Science Data Analysis (SESDA V) RFP Federal contract opportunity
- Solicitation number
- 80GSFC21R005
About this file
This Information Technology Security Management Plan template outlines requirements for a NASA contract to provide information technology services. The contractor must implement security controls across multiple areas including access control, awareness and training, audit and accountability, configuration management, contingency planning, identification and authentication, incident response, maintenance, media protection, physical and environmental protection, planning, personnel security, risk assessment, system and services acquisition, system and communications protection, and system and information integrity. The contractor is responsible for complying with laws and regulations including the Freedom of Information Act, Privacy Act, Federal Information Security Management Act, and NIST cybersecurity standards. Additional details must be provided for security control implementations and FISMA reporting.
View the file
Other files for this federal contract opportunity
Show all 27
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Information Technology Security Management Plan
Issue Date Effective Date:
SENSITIVE BUT UNCLASSIFIED
(SBU) Version 7 03/2021
(Insert Contract # Here)
IT Security Management Plan Review and Approval
This Information Technology Security Management Plan (ITSMP) for the was prepared for the exclusive use of NASA and completed on
I have reviewed the contents of this plan, and believe that it presents an accurate representation.
Reviewed by: ________________________________
ISSO, or equivalent Date
Concurred by: ________________________________
COR/Task Monitor Date
Approved by: ________________________________
Center CISO Date
Accepted by: ________________________________
Contracting Officer Date
SENSITIVE BUT UNCLASSIFIED
Contents
Change History .......................................................................................................................................................................................... ii IT Security Management Plan Review and Approval ............................................................................................................................... iii 1 Contract Identification
1.1 Contract Name
1.2 Contract Number
1.3 Responsible Organization
1.4 Contact Information
1.4.1 Physical Location
1.4.2 Points of Contact
1.5 General Contract Description
1.5.1 Information System Categorization
1.5.2 Security Categorization
1.5.3 Information System
1.5.4 Contractor Badging
1.5.5 Supply Chain Risk Management (SCRM)
1.5.6 Related Laws/Regulations/Policies
2 Security Control Implementations 3 Federal Information Security Management Act (FISMA) Reporting Appendix A: Acronyms
1.5.6 Related Laws/Regulations/Policies
• 5 U.S.C. 552, Freedom of Information Act, 1967
• 5 U.S.C. 552a, Privacy Act, 1974
• FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
• FIPS 200, Minimum Security Requirements for Federal Information and Information Systems
• NIST SP 800-18 Rev. 1, Guide for Developing Security Plans for Federal Information Systems
• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
• NIST SP 800-34 Rev. 1, Contingency Planning Guide for Information Technology Systems
• NIST SP 800-37 Rev. 2, Guide for the Security Authorization of Federal Information Systems
• NIST SP 800-42, Guideline on Network Security Testing
• NIST SP 800-53 Rev. 4, Recommended Security Controls for Federal Information Systems
• NIST SP 800-53A Rev. 4, Techniques and Procedures for Verifying the Effectiveness of Security Controls in Federal
Information Systems
• NIST SP 800-60 v1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories
• NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide
• NIST SP 800-64 v1, Security Considerations in the Information System Development Life Cycle
• OMB Circular A-130, Appendix III, Security of Federal Automated Information Systems
• Public Law (PL) 99-474, The Computer Fraud and Abuse Act of 1986
• PL 93-502 -Freedom of Information Act 1974
• Presidential Decision Directive (PDD-63), Critical Infrastructure Protection Federal Information Security Management Act of 2002 (FISMA)
• NPR 2810.1A, Security of Information Technology
Additional Information: If there is any additional information that you wish to provide, please use the box below.
Version 7 03/2021
File details come from the government source that posted it. Updated .