Exhibit B Data Requirements Document-DRFP version.pdf

Draft Exhibit B 80LARC27R0003

EVALUATIONS, ASSESSMENTS, AND SUPPORT

SERVICES (EASS)

DRAFT Exhibit B

DATA REQUIREMENTS DOCUMENT (DRD)

(Version 0)

National Aeronautics and Space Administration (NASA) Langley Research Center (LaRC)

80LARC27R0003

Draft Exhibit B

DOCUMENT CHANGE LOG

DRD

No.

DRD Title Revision Date

INTRODUCTION

This document defines the requirements for contractual data to be delivered by the Contractor to the Government. The data requirements are set forth in each Data Requirements Description (DRD) and shall govern that data required by the contract. The Contractor shall furnish data defined by the DRDs as listed on the Contract Data Requirements List (CDRL) by category of data, attached hereto, and made a part of this contract. Such data shall be prepared, maintained, and delivered to NASA in accordance with the requirements set forth within this document. In cases where data requirements are covered by a Federal Acquisition Regulation (FAR) or NASA FAR Supplement (NFS) clause or other term (e.g., requirements statement), that clause or term shall take precedence over the DRD.

Contract Data Requirements List (CDRL): Throughout the performance of the contract, the CDRL provides a listing by number, data type, title, and Office of Primary Responsibility

(OPR).

Data Requirements Description (DRD): Each DRD included in this CDRL prescribes content, format, and submittal requirements. The DRDs included in this CDRL are ordered sequentially as listed in the CDRL page(s) that precede(s) the actual DRDs.

Data Type Description: Each DRD is classified by data type as defined below:

TYPE DESCRIPTION

1 – All submittals of and interim changes to Type 1 DRDs require written approval from the contracting officer before formal release for use or implementation.

2 – NASA reserves a time-limited right to disapprove in writing any submittal of and interim changes to Type 2 DRDs. The Contractor shall submit the required data to NASA for review within the time period established in the DRD prior to its release for use or implementation.

The Contractor shall clearly identify the release target date. If the data is unacceptable, the contracting officer will notify the Contractor within the time period established in the DRD from the date of submission, regardless of the intended release date. The Contractor shall resubmit the information for reevaluation if disapproved. The submittal is considered approved if the Contractor does not receive disapproval or an extension request from the contracting officer within the time period established in the DRD.

3 – Type 3 DRDs shall be delivered as required by the contract and do not require NASA approval.

STATEMENT OF GENERAL REQUIREMENTS

Subcontractor Data Requirement The prime Contractor is responsible for flowing down any specific data requirements that apply to subcontracts and vendor agreements.

Reference to subcontractor data in the Contractor’s responses is permissible and a copy of the referenced subcontractor data must be supplied with the response document at time of delivery to NASA.

Data Distribution, Format, and Transmittal Distribution: Distribution recipients and number of copies are identified within each DRD, provided within the contract, or as directed by the Contracting Officer (CO).

Format Electronic Format: Electronic submission of data deliverables is required. Electronic deliverables shall be printable. Data deliverables shall be delivered to NASA in the format specified below unless a specific format is required by a DRD. The preferred native formats include Adobe Acrobat PDF, Microsoft Word, Excel, or PowerPoint, as appropriate.

Transmittal Data shall be transmitted to NASA by email to the recipient identified in the individual DRD, or entry into the specified electronic system (e.g., Contractor Monthly Accident Reporting (CMAR), VETS-4212 reporting, sam.gov, etc.), or other mechanism(s) agreed to by the CO, Contracting Officer’s Representative (COR), and project representatives who are responsible to receive, index, and store the data deliverables. Email size shall be 10 megabytes or less to ensure receipt by the NASA email servers. Encrypted email format shall be used to transmit data.

Document Identification: For all data types, the document number, change legend, date, and title constitute the minimum identification of the specific document and shall appear on the cover and title page. The contract number shall also appear on the cover and title page as separate markings. The originator and organization shall be included on the title page. The document number, change legend, and date shall appear on each page of the document. All Type 1 documentation shall be marked “PRELIMINARY PENDING NASA APPROVAL,” and once approved shall be reissued with “APPROVED BY NASA” and the date and approval authority annotated on the cover.

Data Restriction Determination and Marking Requirements: The Contractor shall properly mark data in accordance with the data rights clause(s) included in the contract. The Contractor must make a determination for each individual data deliverable, and shall not apply a default or blanket data restriction marking to all data deliverables (e.g., “data may be export restricted”). If NASA does not agree with the Contractor applied data restriction, the CO shall return the data to the Contractor, cancel the markings, or ignore the markings consistent with the procedures set forth in the “data rights” clause(s) contained in the contract.

Reference to Other Documents and Data Deliverables in Data Submittals: All referenced documents shall be made readily available to the cognizant NASA organization upon request.

Document Revisions

Revisions of documentation previously submitted may be accomplished either by individual page revision or by a complete reissue of the document.

A document shall be completely reissued when, in the opinion of the Contractor and/or NASA, the document has been revised to the extent that it is unusable in its present state, or when directed by the CO. When complete reissues are made, the entire contents of the document shall be brought up to date and shall incorporate revised pages. All revisions shall be recorded. A revision log shall identify complete reissues except for periodic reports and documents which are complete within themselves as final.

Individual page revisions shall be made as deemed necessary by the Contractor or as directed by the CO.

Changes of a minor nature to correct obvious typing errors, misspelled words, etc., shall only be made when a substantial change is made, unless the accuracy of the document is affected.

All revised pages shall be identified by a revision identifier and a new date. Each document shall contain a log of revised pages that identify the revision status of each page with the revision symbol. This list shall follow the table of contents in each document. The line or lines revised on a given page shall be designated using vertical line in the margin of the page, and the change authority shall be indicated adjacent to the change.

CDRL/DRD MAINTENANCE PROCEDURES

NASA-Initiated Change: New and/or revised data requirements shall be incorporated by contract modification to which the new or revised portion shall be appended. The Contractor shall notify the CO in the event a deliverable data requirement is imposed and is not covered by a DRD, or when a DRD is changed by a contract modification and for which no revision is appended.

CDRL or DRD Change Procedures Revisions to the CDRL or DRDs will be identified by NASA in the Document Change Log. The date of the revision, DRD number, title, and revision description will be annotated in the Document Change Log. Revision descriptions will include the modification number, which implements the change, and a brief description of the portions of the CDRL and/or DRD affected within the “Revision” column of the Document Change Log.

Contract Data Requirements List

DRD

No.

DRD

Type

DRD Title OPR

EASS 1 3 Monthly Progress Report OP

EASS 2 3 Final Reports and Additional Reports of Work OP

EASS 3 2 Security Requirements for Unclassified IT Resources OCIO

EASS 4 3 Employment Reports on Veterans OP

EASS 5 3 Limitations on Subcontracting Report OP

EASS 6 3 Interim Patent Rights Reports OP

EASS 7 3 Final Patent Rights Reports OP

EASS 8 3 Disclosure of Invention Reporting OP

EASS 9 1 Organizational Conflicts of Interest (OCI) Plan OP

EASS 10 3 Staffing Pool List OP

EASS 11 2 Re-procurement Data Package OP

EASS 12 2 Financial Reporting of NASA Property in the Custody of Contractors

(NF 1018)

OP

1. DRD Title: Monthly Progress Report

2. DRD No.: EASS 1 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☒

Administrative ☒

S&MA ☐

10. Description/Use: Monthly progress reports for each task order.

11. Distribution: Contract Specialist/Contracting Officer; Contracting Officer’s Representative; As required by task order

Initial Submission: The initial monthly progress report shall be submitted at the completion of the first month of contract start date.

Submission Frequency: The monthly progress report shall be submitted within 15 calendar days after the end of each calendar monthly report period.

Format: Reports shall be in narrative form, brief, and informal.

Interrelationship: N/A

Applicable Documents: NFS 1852.235-74

Scope: The Contractor shall submit monthly progress reports for the overall contract and for each active task order describing progress of the task to date, noting all technical areas in which effort is being directed and indicating the status of work within these areas.

Contents:

1. A narrative statement of work accomplished during the report period consisting of an overall top-level narrative of the contract as well as a narrative for each task order.

2. A statement, for the purposes of OCI assessment at the overall contract level, of changes in the status of other contracts, whether closed, newly awarded, or planned.

3. A statement of current and potential problem areas and proposed corrective action for the overall contract and for each task order.

4. A discussion of work to be performed during the next report period for the overall contract and for each task order.

Remarks: N/A

Maintenance: Changes shall be incorporated by change page or complete reissue.

1. DRD Title: Final Reports and Additional Reports of Work

2. DRD No.: EASS 2 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: Final report or additional reports of work if required by task order

11. Distribution: Distribution instructions will be provided by NASA.

Initial Submission: In accordance with the instructions contained in NFS 1852.235-73, Final Scientific and Technical Reports or NFS 1852.235-74, Additional Reports of Work – Research and Development.

Submission Frequency: As required by task order.

Format: NASA FAR Supplement clause 1852.235-73 Final Scientific and Technical Reports or NFS 1852.235- 74, Additional Reports of Work – Research and Development.

Interrelationship: N/A

Applicable Documents: NFS 1852.235-73; NFS 1852.235-74

Scope/Contents: Each task order may require the Contractor to submit a Final Report or Additional Reports of Work, either formal or informal, which documents and summarizes the results. The Contractor shall submit reports as required by task order.

Maintenance: Changes shall be incorporated by change page or complete reissue

1. DRD Title: Security Requirements for Unclassified IT Resources

2. DRD No.: EASS 3 3. Data Type: 2 4. OPR: OCIO

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☒

Administrative ☐

S&MA ☐

10. Description/Use: To ensure that IT security requirements, including training, and Cyber Supply Chain Risk Management (C-SCRM), are met during performance of this contract.

11. Distribution: All deliverables required by this DRD, except for the C-SCRM plan, shall be submitted electronically to the CO, COR, and NASA Organization’s Information System Security Officer (ISSO) (i.e., Security Officer). Approval will be provided by the ISSO. If the organization does not have an ISSO, approval will be provided by the NASA Information Owner. C-SCRM plans shall be submitted to and approved by the ICT/C-SCRM Service Element Lead at agency-dl-ocio-cys-cp-scrm@mail.nasa.gov.

Initial Submission:

Information System Security and C-SCRM Plan(s): For contractor-owned systems, due at the start of phase-

in. Initial submission not required for existing, approved plans for Government-owned and Contractor-managed systems. For new Federal Information Systems, due with the delivery of the system.

Non-Federal System Certification: Prior to any transfer of NASA non-public information to the contractor, the contractor shall provide documentation of the certification of the non-federal system to the security officer of the NASA organization that owns the information (typically the organization responsible for the contract). If the organization does not have an ISSO, the attestation shall be provided to the NASA Information Owner.

Information on Employees in Sensitive Positions/Assignments Report: At the start of phase-in

IT Security Point of Contact: At the start of phase-in

IT Security Awareness Training: Training required prior to access to NASA information and systems.

IT Security Role Based Training: Foundational training is provided prior to performance of assigned role. Initial evidence showing completion due at the end of phase-in.

Submission Frequency:

Information System Security Plan(s) and C-SCRM Plan: As Required

Non-Federal System Certification: Annually

Information on Employees in Sensitive Positions/Assignments Report: Annually

IT Security Point of Contact: As Required

IT Security Awareness Training: Annual on anniversary date of initial training

IT Security Role Based Training: Annual on anniversary date of initial training. Evidence of completion due annually.

Format: Unless otherwise directed, the data requested in this DRD shall be delivered to the Government in soft-copy via an electronic transfer mechanism (e.g., electronic mail, flash drive, or file transfer protocol) in a format readable by a Government device utilizing the standards in NASA-STD-2804, “Minimum Interoperability Software Suite.”

Interrelationship: Exhibit A – Performance Work Statement (PWS) Evaluations, Assessment, and Support Services (EASS)

Applicable Documents: Most current versions of the following:

FAR 52.240-91, Security Prohibitions and Exclusions FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems FISMA 2014, Federal Information Security Modernization Act 2014 NFS 1852.240-76, Security Requirements for Unclassified IT Resources NFS 1852.226-73, Major Breach of Safety or Security NFS 1852.237-72, Access to Sensitive Information NFS 1852.237-73, Release of Sensitive Information NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations NPR 1382.1, NASA Privacy Procedural Requirements NPD 2810.1, Information Security Policy NPR 2810.1, Security of Information and Information Systems NPR 2810.7, Controlled Unclassified Information NPR 7120.7, NASA Information Technology Program and Project Management Requirements OMB Circular A-130, Management of Federal Information Resources

Scope: All contracts that purchase, lease, network to, or otherwise utilize covered articles, which includes Government-funded IT (as defined by the FAR) must comply with NASA IT Security and C-SCRM Requirements.

Contents: The Federal Information Security Modernization Act (FISMA) and Executive Branch policy require external providers that process, store, or transmit federal information or operate information systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies.

Information System Security Plan (i.e., System Security Plan, IT Security Plan, or Security Plan):

When the contractor is operating a Federal Information System (FIS) on behalf of NASA or is providing a FIS in the execution of this contract, that system must have an Information System Security Plan in accordance with NIST Special Publication (SP) 800-53, “Security and Privacy Controls for Information Systems and Organizations” at the revision number required at the issuance of the contract. This plan and supporting documents shall be entered into the NASA cybersecurity system of record pursuant to Authorization to Operate (ATO) requirements set forth in NASA Policy Directive 2810.1, “NASA Information Security Policy” and NASA Procedural Requirement (NPR) 2810.1, “Security of Information and Information Systems.” The FIS security plan and ATO must be in place before any system may operate in the NASA environment.

NON-FEDERAL SYSTEM SECURITY CERTIFICATION

When the Contractor will receive, process, store or transmit NASA non-public information, especially Controlled Unclassified Information (CUI) including Personally Identifiable Information (PII) on a non-federal system (e.g., the Contractor’s corporate system) the system must meet the requirements for data https://www.acquisition.gov/far/4.2301 protections detailed in NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”

This documentation may take the form of:

a. A third-party review/audit certifying that the non-federal system meets the requirements of NIST SP 800-

171 or equivalent standard of information protection, such as the ISO 27001 standard, for example.

b. A certification from another federal agency such as the DOD Cybersecurity Maturity Model Certification

(CMMC) Level 2.

INCIDENT NOTIFICATION

The Contractor shall report immediately upon notification any incident involving NASA information on nonfederal (contractor) systems to SOC@nasa.gov.

IT SECURITY POINT OF CONTACT:

The Contractor shall identify a point of contact that NASA may reach in its attempt to address IT and cybersecurity issues. The point of contact shall have the authority to ensure the immediate notification of the NASA Security Operations Center of any incident involving NASA information.

IT SECURITY AWARENESS TRAINING:

Contractor employees subject to this contract, defined as those requiring physical access to NASA facilities or electronic access to NASA systems, shall complete the NASA approved IT Security Awareness Training annually. NASA Cybersecurity and Privacy Awareness training is available through the SATERN online system and must be completed prior to access to NASA information and systems. Completion of the training is tracked automatedly by NASA and must recur each year by the anniversary of the initial training as a condition of continued access. Cybersecurity and Privacy training is updated throughout the year as needed, so there is no defined training period.

CYBERSECURITY AND PRIVACY ROLE BASED TRAINING:

Contractor employees subject to this contract shall complete NASA’s Cybersecurity and Privacy Role-Based Security Training in SATERN related to the following role-based functions prior to performing the role:

• Information System Owner (ISO)

• Information Systems Security Officer (ISSO)

• Information System Security Engineer (ISSE)

NAMS access to these roles in the Risk Information Security Compliance System (RISCS) will be restricted to those that have completed the role-based training within a year of the previous training. Only the training specified in SATERN will be valid for the purpose of fulfilling the training requirement and those who do not take the training annually may be suspended from RISCS access.

INFORMATION ON EMPLOYEES IN SENSITIVE POSITION(S)/ASSIGNMENTS REPORT:

The Information on Employees is Sensitive. IT Security (ITS) Positions/Assignments Report shall provide information annually for personnel screening as required by NPR 2810.1(series), and NPR 1600.1 on position risk.

CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) PLAN:

NIST defines C-SCRM as a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, process, and procedures. A C-SCRM plan addressing contractor systems that will be used in performance of the contract, shall be delivered prior to the processing, transmission, or storage of non-public NASA information on these contractor systems. The C-SCRM plan shall be consistent with the template in NIST SP 800-161, “ICT SCRM Plan Template,” or the attached, optional questionnaire.

mailto:SOC@nasa.gov

Remarks: For all submissions, the government’s time-limited right of disapproval is no greater than 30 calendar days after DRD submission.

Maintenance: Information System Security Plan(s) shall be kept up to date as changes to the baseline configuration of the system(s) occur.

Non-Federal System Certifications shall be maintained annually or per the certifying body’s standard.

Information on Employees in Sensitive Positions/Assignments Report shall be maintained annually.

IT Security Point of Contact shall be kept up to date as changes occur.

Completion of Cybersecurity and Privacy Role Based Training is due annually in SATERN and will be tracked by

NASA.

C-SCRM plans shall be kept up to date as changes occur to organizational C-SCRM processes, policies, and procedures, and/or, new components are introduced.

1. DRD Title: Employment Reports on Veterans

2. DRD No.: EASS 4 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: Annual Veterans’ Employment Report (VETS-4212) Report required by FAR 52.222.37.

11. Distribution: Contract Specialist/Contracting Officer

Initial Submission: Within 30 calendar days following the first VETS-4212 Report submission.

Submission Frequency: Within 30 calendar days following each VETS-4212 Report submission.

Format: Contractor format is acceptable in electronic format that shall be compatible with Microsoft Office.

Interrelationship:

Applicable Documents: VETS-4212 Report; FAR 52.222-37

Scope/Contents: The Contractor shall submit a letter to the Contracting Officer confirming that it has submitted the most recent annual VETS-4212 Report required by FAR 52.222-37.

Maintenance: N/A

1. DRD Title: Limitations on Subcontracting Report

2. DRD No.: EASS 5 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: The purpose of this report is to obtain information necessary to evaluate Contractor compliance with FAR 52.219-14, Limitations on Subcontracting.

11. Distribution: Contract Specialist/Contracting Officer; Contracting Officer’s Representative

Initial Submission: Within 30 calendar days of completion of the first year.

Submission Frequency: Annually within 30 calendar days after completion of each contract year.

Format: Contractor format is acceptable in electronic format that shall be compatible with Microsoft Office.

Interrelationship:

Applicable Documents: Section I Clause 52.219-14, Limitations of Subcontracting

Scope/Contents: The report shall contain sufficient information to demonstrate compliance with the requirement specific to 52.219-14(e). The report shall contain sufficient information to demonstrate compliance with the requirement that the Contractor “will not pay more than 50 percent of the amount paid by the Government for contract performance to subcontractors that are not similarly situated entities.”

1. DRD Title: Interim Patent Rights Report

2. DRD No.: EASS 6 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: Annual list of subject inventions required to be disclosed as set forth in FAR 52.227-11, Patent Rights-Ownership by the Contractor (as modified by NFS 1852.227-11, Patent Rights-Retention by the Contractor).

11. Distribution: Contract Specialist/Contracting Officer; Contracting Officer’s Representative; New Technology Representative, LaRC-New-Technology@mail.nasa.gov, and Patent Representative at https://invention.nasa.gov or NF 1679 submission to LaRC-New-Technology@mail.nasa.gov

Initial Submission: Annually as required by FAR 52.227-11; NFS 1852.227-11

Submission Frequency: Annually as required by FAR 52.227-11; NFS 1852.227-11

Format: As required by FAR 52.227-11; NFS 1852.227-11

Interrelationship: N/A

Applicable Documents: FAR 52.227-11; NFS 1852.227-11

Scope/Contents: The Contractor shall submit an annual list of subject inventions required to be disclosed as set forth in FAR 52.227-11, Patent Rights-Ownership by the Contractor (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor). The annual list of subject inventions shall be provided for each Task Order and include applicable Task Order information. A summary report shall also be provided for each overarching contract. The Contractor shall submit the Interim New Technology Summary Report through the e-NTR New Technology Reporting System website at https://invention.nasa.gov/.

Remarks: N/A

Maintenance: Changes shall be incorporated by change page or complete reissue.

mailto:LaRC-New-Technology@mail.nasa.gov https://invention.nasa.gov/ mailto:LaRC-New-Technology@mail.nasa.gov https://invention.nasa.gov/

1. DRD Title: Final Patent Rights Report

2. DRD No.: EASS 7 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC2R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: Listing of all subject inventions required to be disclosed or certify that there were none as set forth in FAR 52.227-11 Patent Rights- Ownership by the Contractor (as modified by NFS 1852.227-11, Patent Rights-Retention by the Contractor).

11. Distribution: Contract Specialist/Contracting Officer; Contracting Officer’s Representative; New Technology Representative, LaRC-New-Technology@mail.nasa.gov, and Patent Representative at https://invention.nasa.gov or NF 1679 submission to LaRC-New-Technology@mail.nasa.gov

Initial Submission: This report is due within three (3) months after completion of the contracted work.

Submission Frequency:

Format: As required by FAR 52.227-11; NFS 1852.227-11

Interrelationship: N/A

Applicable Documents: FAR 52.227-11; NFS 1852.227-11

Scope/Contents: The Contractor shall submit a listing of all subject inventions required to be disclosed or certify that there were none as set forth in FAR 52.227-11 Patent Rights- Ownership by the Contractor (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor). The Contractor shall submit the Final New Technology Summary Report through the e-NTR New Technology Reporting System website at https://invention.nasa.gov/.

mailto:LaRC-New-Technology@mail.nasa.gov https://invention.nasa.gov/

1. DRD Title: Disclosure of Invention Reporting

2. DRD No.: EASS 8 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: Disclosure of subject inventions under the contract as set forth in FAR 52.227-11, Patent Rights-Ownership by the Contractor, (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor).

11. Distribution: Contract Specialist/Contracting Officer; Contracting Officer’s Representative; New Technology Representative, LaRC-New-Technology@mail.nasa.gov, and Patent Representative at https://invention.nasa.gov or NF 1679 submission to LaRC-New-Technology@mail.nasa.gov

Initial Submission: See submission frequency.

Submission Frequency: Disclosures are required within two (2) months after the inventor discloses the invention in writing to Contractor personnel who are responsible for patent matters.

Format: FAR 52.227-11; NFS 1852.227-11; NASA Form 1679

Interrelationship: N/A

Applicable Documents: FAR 52.227-11; NFS 1852.227-11; NASA Form 1679

Scope/Contents: The Contractor shall disclose each subject invention under the contract as set forth in FAR 52.227-11, Patent Rights-Ownership by the Contractor, (as modified by NFS 1852.227-11, Patent Rights- Ownership by the Contractor). NASA prefers that the Contractor use the e-NTR New Technology Reporting System website at https://invention.nasa.gov/ for this reporting. The contractor may also utilize the paper version of NASA Form 1679.

Remarks: N/A

Maintenance: Changes shall be incorporated by change page or complete reissue.

mailto:LaRC-New-Technology@mail.nasa.gov https://invention.nasa.gov/

1. DRD Title: Organizational Conflicts of Interest (OCI) Plan

2. DRD No.: EASS 9 3. Data Type:1 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: The Plan will communicate the Contractor’s approach to identify and resolve OCIs.

The Contractor will be held accountable for identifying, dispositioning, and reporting OCIs during contract performance.

11. Distribution: Contract Specialist/Contracting Officer and Contracting Officer’s Representative

Initial Submission: The Plan shall be submitted with the initial proposal (See L.10 and L.18) and supplemental plans may be required for individual task orders in accordance with the contract clause NFS 1852.216-80 Task Ordering Procedure, and as defined in the order.

Submission Frequency: As needed.

Format: Contractor’s format is acceptable. The electronic format shall be compatible with Microsoft Office.

Interrelationship: To ensure compliance with the broad OCI and Personal Conflict of Interest (PCI) requirements of this contract, the contractor’s OCI Plan shall integrate with all aspects of contract performance, the Performance Work Statement (Exhibit A), the applicable documents and references listed below, and integrated in other DRDs as required (e.g., Monthly Report).

Applicable Documents, Contract Clauses, and References:

• FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest

• NFS 1809.5, Organizational and Consultant Conflicts of Interest

• FAR Subpart 3.10, Contractor Code of Business Ethics and Conduct (Ref. FAR 52.203-13, Contractor

Code of Business Ethics and Conduct

• FAR Subpart 3.11, Preventing Personal Conflicts of Interest for Contractor Employees Performing

Acquisition Functions (FAR 52.203-16, Preventing Personal Conflicts of Interest)

• NFS 1837.802-70, Release of Contractor’s Sensitive Information

• NFS 1852.237-72, Access to Sensitive Information

• NFS 1852.237-73, Release of Sensitive Information

• NFS 1852.209-71, Limitation of Future Contracting (Ref. FAR 9.507-2 and NFS 1809.507-2, required clause that specifies the nature and duration of the proposed constraint)

• NFS 1852.216-80, Task Ordering Procedures

• Web sites for the following documents:

• NASA’s Guide on Organizational Conflicts of Interest (March 2010, until superseded)

• SMD Policy on Peer Review Conflicts of Interest (SPD-01A) (February 2007)

• NASA Standing Review Board Handbook (January 2023, until superseded)

Scope: The OCI Plan describes the Contractor’s comprehensive approach to identify, avoid, mitigate, neutralize, and report potential and actual OCI and PCI issues, including conflicts described in the solicitation https://www.nasa.gov/wp-content/uploads/2023/09/nasa-organizational-conflicts-of-interest.pdf https://science.nasa.gov/wp-content/uploads/2023/04/SPD_01A_Peer_Review_Conflicts_of_Interest_TAGGED.pdf https://ntrs.nasa.gov/citations/20230001306 and those discovered during contract performance.

Contents: The OCI Plan shall meet the requirements of FAR 9.5, FAR 3.11, the applicable documents, contract clauses, and references, and include the following:

1. Point of contact for OCI issues and reports.

2. Demonstrate an understanding of (1) OCI principles, (2) the General Rules covered in FAR 9.505 and

Procedures in FAR 9.506, (3) the Procedures in FAR 3.1103 and Mitigation or waiver in FAR 3.1104, and (4) the full breadth of OCI issues and the types of harm that can result. The Plan at a minimum shall address the three primary types of OCIs (i.e., biased ground rules, unequal access to information, and impaired objectivity).

3. Define company roles, responsibilities, and procedures for (1) screening (i.e., identifying/recognizing, analyzing/evaluating, resolving, and reporting) existing and new business opportunities for actual/potential OCIs and (2) monitoring and reporting all potential/actual OCIs that arise, coordinating with Business Units (e.g., parent, subsidiaries, affiliates, office locations, divisions, joint ventures, and/or other similar entities), resolving conflicts, and reporting previously unidentified OCIs or potential OCIs to the Government.

4. Given the nature of the services required by this contract, covered employees may encounter personal conflicts of interest (PCIs) resulting from a financial interest, personal activity, or relationship that could impair the covered employees’ ability to act impartially and in the best interest of the government. For the purposes of PCI, the term “covered employee” is a Contractor employee, subcontractor employee, or consultant. PCI Avoidance: Describe the procedure to screen all covered employees to prevent PCIs including those PCIs that cannot be identified until after award; how the Contractor screens covered employees at appropriate times to prevent and avoid PCIs and maintain effective oversight, how the Contractor prevents PCIs by not assigning or allowing covered employees to perform on tasks where a potential PCI is identified unless approved by the Contracting Officer; and, how the Contractor ensures that all personnel (including subcontractor personnel and independent contractors) proposed to work on the task order have been trained regarding their responsibilities concerning PCIs, OCIs, limitations on future contracting, and protection of proprietary and sensitive data.

5. Describe how employees are notified of the Plan’s requirements and how this notification will be documented. Establish and require entrance training for new employees, refresher training for existing employees, and exit training for departing employees. Employee training must address: (1) compliance with this Plan; and (2) the obligation of employees with access to sensitive information to utilize it only to perform the services specified in this contract and to safeguard it from unauthorized use and disclosure. Describe how completion of this training will be documented, including a copy of any training certification template that the Contractor will use to document that its employees have completed training. Describe the mechanism for obtaining a written affirmation from each contractor employee that he/she has received and will comply with training on the authorized uses and mandatory protections of sensitive information needed in performing this contract. Describe processes for addressing potential and actual Personal Conflicts of Interest.

6. Describe how the Contractor will report breaches of the protective measures in the Plan to the contracting officer and task monitor as delegated. Describe what processes the Contractor will implement following any breach and indicate that final resolution of the corrective action must be approved by the contracting officer (CO). For example, the OCI Plan must reflect that the contractor will take all immediate steps needed to contain or limit the impact of a breach, notify the CO of the breach, and coordinate the corrective action approach as soon as possible.

7. Identify any affiliated companies/entities (e.g., a parent company or a wholly owned subsidiary) and procedures for coordinating OCIs with such affiliated companies/entities.

8. Address the process for reporting all potential/actual OCIs or PCIs that arise during performance of the contract. An OCI or PCI report shall include (1) a description of the conflict, (2) the plan for resolving the conflict, and (3) the benefits/risks to contract performance associated with plan approval/acceptance.

Broadly applicable resolution strategies shall be appended to the Plan upon approval by the Government.

9. Explain how the Contractor will flow down the provisions of this Plan to any subcontractor and independent contractor that may have a conflict with regard to performing the requirements of this contract. Discuss affected subcontractors’ OCI and PCI program as it relates to this contract and specifically explain how affected subcontractors will identify, resolve, and report actual/potential OCIs or PCIs associated with this contract.

10. Define organizational, employee, and subcontractor sanctions for violations of established OCI and PCI procedures/requirements/guidelines.

11. Include an assertion from the offeror that to the best of its knowledge no OCIs exist currently, if applicable. Provide a list of all the prime’s and proposed subcontractor(s)’s NASA contracts and subcontracts currently being performed, contracts performed within the last five years of the release of this solicitation, and contracts being considered in the next two (2) years in order to provide the CO a better understanding of other NASA work performed by the offeror that may give rise to an actual or potential conflict. For each prime contract and subcontract listed, the offeror shall: (1) identify the contract number; (2) describe the scope of work in sufficient detail to ascertain the likelihood of a conflict with performance of this contract; and (3) discuss any conflicts that may arise from performance of the listed contracts and award of this contract. Note: Attention should be paid to organizations that are involved in or have a potential interest in Science Mission Directorate (SMD) programs and investigations.

12. The offeror shall also list any non-NASA Federal contracts and subcontracts that it or its proposed subcontractors are currently performing, have performed in the five years preceding the release of the solicitation, and are being considered in the next year that may give rise to an OCI. For each prime contract and subcontract listed, the offeror shall: (1) identify the contract by number and name; (2) identify the name, address and contact information of the customer(s); (3) describe the scope of work in sufficient detail to ascertain the likelihood of a conflict with performance of this contract; and (4) discuss any conflicts that may arise from performance of the listed contracts and award of this contract.

Note: Attention should be paid to organizations that are involved in or have a potential interest in SMD programs and investigations.

13. For financial or other interests or relationships that may give rise to an OCI, the offeror shall (1) address the nature and extent of the interest(s) or relationship(s); (2) list any entity or entities involved in the interest(s) or relationship(s) and award of this contract.

14. The offeror shall address how it will avoid, neutralize, or mitigate each potential OCI listed above.

Sufficient information must be provided to allow a meaningful evaluation of the potential effect of the interest on the performance of the PWS.

15. Include a requirement to update this plan as necessary to address specific OCIs and PCIs. All updates to the plan must be approved by the contracting officer and the updates/changes must be incorporated in the contract to be effective.

16. Require periodic self-audits to ensure compliance with established OCI and PCI procedures/requirements/guidelines.

17. Define records related to the OCI plan (e.g., training and audit records) that will be made available to the Government upon request. At a minimum, the offeror shall make available those records which show their compliance to the Applicable Documents cited above. The offeror shall address its plan and process to meet (1) in accordance with NFS 1837.802-70, Release of Contractor’s Sensitive Information, NFS 1852.237-72, Access to Sensitive Information, and NFS 1852.237-73, Release of Sensitive Information, (including the contractor’s obligation to safeguard sensitive information and preclude access by or disclosure to persons and entities outside of its organization, and how the contractor will allow access to sensitive information only to those employees who need it to perform services under the contract), (2) the contractor’s obligation to conduct business in an ethical manner in accordance with FAR 52.203-13, contractor’s Code of Business Ethics and Conduct, and (3) the contractor’s obligation to prevent personal conflicts of interest in accordance with FAR 52.203-16, Preventing Personal Conflicts of Interest.

18. In an appendix to the OCI Plan identify the strategy (e.g., mitigation, limitation on future contracting) for resolving each potential or actual OCI that is identified in the solicitation, created by the requirements of the solicitation/contract, or created by requirements of a task order, and explain the effect of such strategy on performance of the contract. The offeror, or any teaming partner, must not expect that use of a firewall within its own organization to mitigate “impaired objectivity” or “unequal access to information” OCIs will be acceptable to NASA, including under joint venture or affiliated company relationships. Such firewalls generally provide insufficient mitigation for an “impaired objectivity” type of OCI. Additionally, the offeror must not expect that the use of firewalled subcontractors to mitigate “impaired objectivity” OCIs will be acceptable to NASA. Use of such firewalls, except in extremely limited circumstances, prevents the offeror from effectively managing its subcontractor(s) and the task. Note: Specific plans to limit future competition are reflected in the clause at NFS 1852.209-71, Limitation of Future Contracting.

19. SMD Announcements of Opportunity (AOs) specify that the Contractor will be subject to a “Full Limitation,” in which this contract creates an unmitigable organizational conflict of interest for the contractor in the event that any business unit of the contractor has a proposed role as prime contractor, subcontractor, or participating organization. Because of this organizational conflict of interest, the contractor is precluded from participating in any capacity in support of a respondent under an SMD AO.

Maintenance: The Contractor shall review the OCI Plan on an annual basis or as directed by the CO to revise the OCI Plan if necessary. Revisions are subject to CO approval and shall be incorporated by change page or complete reissue.

1. DRD Title: Staffing Pool List

2. DRD No.: EASS 10 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: The Staffing Pool List will contain information on all individuals who performed under this contract.

11. Distribution: Contract Specialist/Contracting Officer and COR

Initial Submission: List shall be submitted with the initial proposal.

Submission Frequency: List due no later than 14 calendar days after the start of each contract year and upon closure of the final task order.

Format: Contractor’s format is acceptable

Interrelationship: N/A

Applicable Documents: N/A

Scope: The Staffing Pool List shall be established and maintained containing information on all individuals who performed under this contract.

Contents: The list shall include, but not be limited to, the individual’s name, contact information, organization/company, areas of expertise, evaluations/assessments/studies supported, and roles performed.

Maintenance: Updated as needed.

1. DRD Title: Re-procurement Data Package

2. DRD No.: EASS 11 3. Data Type: 2 4. OPR: Office of Procurement

(OP)

5. Solicitation No.: 80LARC27R0003 6. Contract No.: TBD

7. Date Issued: TBD 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: To provide the Government with information on specific items and supporting documentation related to labor resources and associated price information, to be used for re-procurement activities.

In the event of a competitive solicitation for a follow-on effort, NASA may provide nonproprietary historical information such as average composite direct labor rates, number of Work Year Equivalent (WYE) personnel, and approximated seniority level profiles of incumbent personnel to all interested parties in order to increase the probability of realistic pricing. Specific rates for individual labor categories will not be disclosed.

11. Distribution: Contract Specialist/Contracting Officer, Contracting Officer’s Representative.

Initial Submission: 30 calendar days after the completion of Year 1 of the contract.

Submission Frequency: Annually, no later than the 15th calendar day of the month following the end of each twelve-month period of contract performance. If deemed necessary by the CO, prime and subcontractors shall submit the data package at times other than stated.

Interrelationship: N/A

Applicable Documents: N/A

DATA PREPARATION INFORMATION:

Scope: The Re-Procurement Data Package provides NASA with information on specific items and supporting documentation related to labor resources and associated price information, to be used for re-procurement activities.

Contents: The Re-Procurement Data Package shall contain the following labor resource/price information. This data shall be required from the prime and subcontractors:

1. Labor Resources and Price Information:

a. Data package shall include all direct labor supporting this contract, segregated by contract labor category description, and mapped to the contractor's labor category (as applicable). Each labor category shall detail the number of WYEs in relation to each Performance Work Statement (PWS) section supported. The WYE detail shall be at the lowest PWS level for which current contract tracking is available. In the event any labor category supports multiple PWS sections, ensure WYEs counted at a lower PWS level are not counted again at a higher PWS level. See Business Specialist labor category example provided below in Table 1.

Table 1: Example of Data Required per Paragraph (l a):

Labor Category Description

Contractor Labor Category

PWS

Section

*No. of WYEs

Business Specialist

Accountant I 1.2 1.75

Engineer I Jr Mechanical Eng 3.2.4 6.25 (Not Included in 3.0)

Engineer II Jr Mechanical Eng 6.1 4.5

*A WYE is defined as the work of a full-time equivalent person based on your accounting system. For example, if your accounting system dictates that a WYE constitutes 1,880 productive hours (total hours minus paid time off), then four people working 470 hours per year would make up one FTE.

b. Data package shall also include the current average direct labor rate and fringe benefits rate for each direct labor category previously identified. Further, the data package shall provide both the date when these direct labor rates and/or fringe benefits rates were last adjusted for escalation by each contractor labor category, and the rate of escalation applied. The data package shall also indicate whether any future adjustments are projected to occur prior to contract expiration, to include the anticipated date and rate of escalation, as well shall identify the exemption status of each contractor labor category.

Ensure the total number of WYEs for each labor category aligns with the summation of all previously identified WYEs of the same labor category. See Business Specialist labor category example provided below in Table 2 in relation to Table 1 above.

Table 2: Example of Data Required per Paragraph (1 b)

Labor Category

Description

Contractor Labor Category

Total No.

of WYEs

**Direct Labor Rate

***Fringe Benefits

Rate

Last Escalation Date and Amount

Future Escalation Date and Amount

****Exempt or Non-exempt?

Business Specialist

Accountant I 1.75 $23.25 April 2014 (2.70%)

April 2015 (2.20%)

Exempt

Engineer I Jr Mechanical Eng 15.55 $26.12 April 2014 (2.70%)

April 2015 (2.20%)

Exempt

**Current average hourly direct labor rate (unburdened) ***Current average hourly fringe benefits rate (unburdened) ****Exemption status relative to applicability against Service Contract Labor Standards (formerly known as the Service Contract Act), provisions of the Fair Labor Standards Act, and related Secretary of Labor regulations and instructions

c. WYE Seniority Level Profiles: For the purpose of fringe benefit calculations, the data package shall include the seniority level of all WYEs, segregated by each labor category and exemption status previously identified, as follows:

i. Number of FTEs with 0 to 5 years of experience.

ii. Number of FTEs with greater than 5 years and up to 10 years of experience.

iii. Number of WYEs with greater than 10 years and up to 15 years of experience.

iv. Number of WYEs with greater than 15 years of experience.

d. Associated Price for Non-Labor Resources: The data package shall provide total non-labor resource price incurred for the most recent twelve-month contract period, grouped by the following expense types, as applicable:

i. Travel.

ii. Training.

iii. Any additional non-labor resource categories identified by the CO

Format: Electronic format of data package submittals shall consist of a single Adobe Acrobat PDF file and the contractor's native Excel electronic file. Contractor format of Excel file is acceptable, provided all requested data package content is included.

Remarks: For all submissions, the government’s time-limited right of disapproval is no greater than 30 calendar days after DRD submission.