Exhibit B EGSS Contract Data Requirements List.pdf

Exhibit B 80LARC24R0003

Exhibit B

Contract Exhibit B

NASA ENTEPRISE GEOSPATIAL SUPPORT

SERVICES (EGSS)

CONTRACT DATA REQUIREMENTS LIST

National Aeronautics and Space Administration Langley Research Center

DOCUMENT CHANGE LOG

DRD

No.

DRD Title Revision Date

INTRODUCTION

This document defines the requirements for contractual data to be delivered by the contractor to the Government. The data requirements are set forth in each Data Requirements Description (DRD) and shall govern that data required by the contract. The contractor shall furnish data defined by the DRDs as listed on the Contract Data Requirements List (CDRL) by category of data, attached hereto, and made a part of this contract. Such data shall be prepared, maintained, and delivered to NASA in accordance with the requirements set forth within this document. In cases where data requirements are covered by a Federal Acquisition Regulation (FAR) or NASA FAR Supplement (NFS) clause or other term (e.g., requirements statement), that clause or term shall take precedence over the DRD.

Contract Data Requirements List (CDRL): Throughout the performance of the contract, the CDRL provides a listing by number, data type, title, and Office of Primary Responsibility (OPR).

Data Requirements Description (DRD): Each DRD included in this CDRL prescribes content, format, and submittal requirements. The DRDs included in this CDRL are ordered sequentially as listed in the CDRL page(s) that precede(s) the actual DRDs.

Data Type Description: Each DRD is classified by data type as defined below:

TYPE DESCRIPTION

1 - All submittals of and interim changes to Type 1 DRDs require written approval from the contracting officer before formal release for use or implementation.

2 - NASA reserves a time-limited right to disapprove in writing any submittal of and interim changes to Type 2 DRDs. The contractor shall submit the required data to NASA for review within the time period established in the DRD prior to its release for use or implementation. The contractor shall clearly identify the release target date. If the data is unacceptable, the contracting officer will notify the contractor within the time period established in the DRD from the date of submission, regardless of the intended release date. The contractor shall resubmit the information for reevaluation if disapproved. The submittal is considered approved if the contractor does not receive disapproval or an extension request from the contracting officer within the time period established in the DRD.

3 – Type 3 DRDs shall be delivered as required by the contract and do not require NASA approval.

STATEMENT OF GENERAL REQUIREMENTS

Subcontractor Data Requirement The prime contractor is responsible for flowing down any specific data requirements that apply to subcontracts and vendor agreements.

Reference to subcontractor data in the contractor’s responses is permissible and a copy of the referenced subcontractor data must be supplied with the response document at time of delivery to NASA.

Data Distribution, Format, and Transmittal Distribution: Distribution recipients and number of copies are identified within each DRD, provided within the contract, or as directed by the Contracting Officer

(CO).

Format Electronic Format: Electronic submission of data deliverables is required.

Electronic deliverables shall be printable. Data deliverables shall be delivered to NASA in the format specified below unless a specific format is required by a DRD. Data submittals shall consist of a single Adobe Acrobat PDF file and the native format electronic file(s). The preferred native formats include Microsoft Word, Excel, or PowerPoint, as appropriate.

Transmittal Data shall be transmitted to NASA by email to the recipient identified in the individual DRD, or entry into the specified electronic system (e.g., Contractor Monthly Accident Reporting (CMAR), VETS-4212 reporting, sam.gov, etc.), or other mechanism(s) agreed to by the Contracting Officer (CO), Contracting Officer’s Representative (COR), and project representatives who are responsible to receive, index, and store the data deliverables.

If email is used to transmit data deliverables, the email size shall be 10 megabytes or less to ensure receipt by the NASA email servers. Encrypted email format shall be used to transmit data.

Document Identification: For all data types, the document number, change legend, date, and title constitute the minimum identification of the specific document and shall appear on the cover and title page. The contract number shall also appear on the cover and title page as separate markings. The originator and organization shall be included on the title page. The document number, change legend, and date shall appear on each page of the document. All Type 1 documentation shall be marked “PRELIMINARY PENDING NASA APPROVAL,” and once approved shall be reissued with “APPROVED BY

NASA” and the date and approval authority annotated on the cover.

Data Restriction Determination and Marking Requirements: The contractor shall properly mark data in accordance with the data rights clause(s) included in the contract. The contractor must make a determination for each individual data deliverable, and shall not apply a default or blanket data restriction marking to all data deliverables (e.g., “data may be export restricted”). If NASA does not agree with the contractor applied data restriction, the CO shall return the data to the contractor, cancel the markings, or ignore the markings consistent with the procedures set forth in the “data rights” clause(s) contained in the contract.

Reference to Other Documents and Data Deliverables in Data Submittals: All referenced documents shall be made readily available to the cognizant NASA organization upon request.

Document Revisions Revisions of documentation previously submitted may be accomplished either by individual page revision or by a complete reissue of the document.

A document shall be completely reissued when, in the opinion of the contractor and/or NASA, the document has been revised to the extent that it is unusable in its present state, or when directed by the CO. When complete reissues are made, the entire contents of the document shall be brought up to date and shall incorporate revised pages. All revisions shall be recorded. A revision log shall identify complete reissues except for periodic reports and documents which are complete within themselves as final.

Individual page revisions shall be made as deemed necessary by the contractor or as directed by the CO.

Changes of a minor nature to correct obvious typing errors, misspelled words, etc., shall only be made when a substantial change is made, unless the accuracy of the document is affected.

All revised pages shall be identified by a revision identifier and a new date. Each document shall contain a log of revised pages that identify the revision status of each page with the revision symbol. This list shall follow the table of contents in each document. The line or lines revised on a given page shall be designated using vertical line in the margin of the page, and the change authority shall be indicated adjacent to the change.

CDRL/DRD MAINTENANCE PROCEDURES

NASA-Initiated Change: New and/or revised data requirements shall be incorporated by contract modification to which the new or revised portion shall be appended. The contractor shall notify the CO in the event a deliverable data requirement is imposed and is not covered by a DRD, or when a DRD is changed by a contract modification and for which no revision is appended.

CDRL or DRD Change Procedures Revisions to the CDRL or DRDs will be identified by NASA in the Document Change Log. The date of the revision, DRD number, title, and revision description will be annotated in the Document Change Log. Revision descriptions will include the modification number, which implements the change, and a brief description of the portions of the CDRL and/or DRD affected within the “Revision” column of the Document Change Log.

Contract Data Requirements List

DRD

No.

DRD

Type

DRD Title OPR

1 3 Diversity, Equity, and Inclusion Plan Office of Procurement

(OP)

2 1 Organizational Conflict of Interest

OP

3 1 Contract Management Plan Office of Strategic

Infrastructure

(OSI)

4 1 Contract Phase-In Plan OSI

5 1 Monthly Performance Management Review Report OSI

6 1 Information Security Management Plan Office of the Chief

Information Officer

(OCIO)

7 1 Contractor Mishap and Safety Statistics Reports Office of Safety and

Mission Assurance

(OSMA)

8 1 Safety and Health (S&H) Plan OSMA

1. DRD Title: Diversity, Equity, Inclusion, and Accessibility (DEIA) Plan

2. DRD No.: 1 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80LARC24R0003

6. Contract No.: TBD

7. Date Issued: TBD

8. Date Revised: TBD 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: The DEIA plan demonstrates the contractor’s commitment to fairness regarding diversity, equity, inclusion, and accessibility. This plan will provide NASA with an understanding of how the contractor plans to recruit, retain, and develop a diverse high performing workforce from underserved communities. The plan shall include measurable performance metrics and objectives. The DEIA plan will be utilized as an assessment tool by the contracting officer to monitor the contractor’s progression in its commitment to diversifying its workforce.

11. Distribution: Contract Specialist, Contracting Officer’s Representative, Deputy Contracting Officer’s Representative

Initial Submission: Draft plan shall be submitted within 30 days after contract award for NASA’s review, comment, and joint discussion with the contractor to arrive at a final DEIA plan to be incorporated into the contract within 60 days of award.

Submission Frequency: Update annually

Format: Contractor’s format is acceptable.

Interrelationship: N/A

Applicable Documents: Executive Order 13985, Advancing Racial Equity and Support for Underserved Communities Through the Federal Government

Scope: In support of the Executive Order 13985, Advancing Racial Equity and Support for Underserved Communities Through the Federal Government, NASA is seeking to advance equity or remove barriers for members of underserved communities to access procurement opportunities. Underserved communities refer to populations sharing a particular characteristic, as well as geographic communities, that have been systematically denied a full opportunity to participate in aspects of economic, social, and civic life. Underserved Communities include Black, Latino, Indigenous, Native American, Asian Americans and Pacific Islanders and other persons of color; members of religious minorities; lesbian, gay, bisexual, transgender, and queer (LGBTQ+) persons; persons with disabilities; persons who live in rural areas; and persons otherwise adversely affected by persistent poverty or inequality.

Contents:

The DEIA Plan shall identify qualitative and quantitative approaches utilized to measure progress in the areas of Leadership and Commitment, Diverse Talent, and Culture and Sustainability. The following shall be addressed annually:

Leadership and Commitment – Demonstrate leadership’s commitment and accountability to diversity, equity, and inclusion. Identify quantitative approaches utilized to measure progress of a Diversity and Inclusion program

1. What is the operational status of, and level of resources available to, offices or divisions within the organization that are responsible for advancing civil rights or whose mandates specifically include serving underrepresented or disadvantaged communities?

2. What actions has the organization taken to implement affirmative equity-enhancing policies, regulations, guidance, and approaches to emphasizing equity in policy- and rule-making processes?

3. Describe how the organization’s commitment will be communicated internally and externally from leadership to employees and stakeholders.

Diverse Talent – Demonstrate a pursuit of a high performing diverse workforce from underserved communities.

1. Discuss the specific diversity metrics utilized by the organization to measure performance in achieving a diverse workforce and provide the corresponding metrics for the current or most recent organizational reporting period

2. What barriers or opportunities exist to engage subject matter experts from underserved communities in industry and academia? How does the organization plan to overcome those barriers?

3. How will underserved communities be leveraged?

4. Describe recruiting activities, objectives, and outcomes (e.g., number of participants, number interviewed and hired from underserved communities).

Culture & Sustainability – Demonstrate how an inclusive and fair work environment will be cultivated and maintained.

1. Based on the data, what structures and strategies will be used to manage diversity, measure results, refine approaches, and institutionalize a culture of inclusion?

2. Identify actionable opportunities to improve data collection, use, and sharing that would allow for disaggregation, the ability to deliver services more equitably, and better understanding of how programmatic and policy decisions impact underserved communities.

3. Describe other corporate activities that seek to increase support of diversity, equity, and inclusion.

Remarks: N/A

Maintenance: Changes shall be incorporated by change page or complete reissue.

1. DRD Title: Organizational Conflicts of Interest (OCI) Plan

2. DRD No.: 2 3. Data Type: 1 4.OPR: OP

5. Solicitation No.: 80LARC24R0003 6. Contract No.: TBD

Administrative ☒

S&MA ☐

10. Description/Use: The Plan will communicate the contractor’s approach to identify and resolve OCIs. The contractor will be held accountable for identifying, dispositioning, and reporting OCIs during contract performance.

11. Distribution: Contract Specialist, Contracting Officer’s Representative, and Deputy Contracting Officer’s Representative

Initial Submission: Draft plan shall be submitted within 30 days after contract award for NASA’s review, comment, and joint discussion with the contractor to arrive at a final OCI plan to be incorporated into the contract within 60 days of award.

Submission Frequency: As needed.

Format: Contractor format is acceptable

Interrelationship: NASA Federal Acquisition Regulation (FAR) Supplement (NFS) 1852.209-71, Limitation of Future Contracting, NFS 1852.237-72, Access to Sensitive Information, NFS 1852.237-73, Release of Sensitive Information.

Applicable Documents: FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, NFS 1809.500, NASA Guide on Organizational Conflicts of Interest.

Scope: The OCI Plan describes the contractor’s comprehensive approach to identify, avoid, mitigate, neutralize, and report potential OCI issues, including conflicts described in the solicitation and those discovered during contract performance.

Contents: The OCI Plan shall meet the requirements of FAR 9.5 and include the following:

1. Point of contact for OCI issues and reports.

2. Demonstrate an understanding of (1) OCI principles and (2) the full breadth of OCI issues and the types of harm that can result. The Plan at a minimum addresses the three primary types of OCIs (i.e., biased ground rules, unequal access to information, and impaired objectivity).

3. Define company roles, responsibilities, and procedures for (1) screening (i.e., identifying/recognizing, analyzing/evaluating, resolving, and reporting) existing and new business opportunities for actual/potential OCIs and (2) monitoring and reporting all potential/actual OCIs that arise, resolving conflicts, and reporting previously unidentified OCIs or potential OCIs to the Government.

4. Describe how employees are notified of the Plan’s requirements and how this notification will be documented. Establish and require entrance training for new employees, refresher training for existing employees, and exit training for departing employees. Describe how completion of this training will be documented, including a copy of any training certification template that the contractor will use to document that its employees have completed training.

5. Describe how the contractor will report breaches of the protective measures in the Plan to the contracting officer. Describe what processes the contractor will implement following any breach and indicate that final resolution of the corrective action must be approved by the contracting officer.

6. Identify any affiliated companies/entities (e.g., a parent company or a wholly owned subsidiary) and procedures for coordinating OCIs with such affiliated companies/entities.

7. Address the process for reporting all potential/actual OCIs that arise during performance of the contract. An OCI report shall include (1) a description of the conflict, (2) the plan for resolving the conflict, and (3) the benefits/risks to contract performance associated with plan approval/acceptance. Specific resolution strategies shall be appended to the Plan upon approval by the Government.

8. Explain how the contractor will flow down the provisions of this Plan to any subcontractor that may have a conflict with regard to performing the requirements of this contract. Discuss affected subcontractors’ OCI program as it relates to this contract and specifically explain how affected subcontractors will identify, resolve, and report actual/potential OCIs associated with this contract.

9. Define organizational and employee sanctions for violations of established OCI procedures/requirements/guidelines.

10. Include an assertion from the Offeror that to the best of its knowledge no OCIs exist currently, if applicable. Provide a list of all the prime’s and proposed subcontractor(s)’s NASA contracts and subcontracts currently being performed and contracts performed within the last five years of the release of this solicitation, in order to provide the CO a better understanding of other NASA work performed by the Offeror that may give rise to an actual or potential conflict. For each prime contract and subcontract listed, the Offeror shall: (1) identify the contract number; (2) describe the scope of work in sufficient detail to ascertain the likelihood of a conflict with performance of this contract; and (3) discuss any conflicts that may arise from performance of the listed contracts and award of this contract.

11. The Offeror shall also list any non-NASA Federal contracts and subcontracts that it or its proposed subcontractors are currently performing or have performed in the five years preceding the release of the solicitation that may give rise to an OCI. For each and subcontract listed, the Offeror shall: (1) identify the contract by number and name; (2) identify the name, address and contact information of the customer(s); (3) describe the scope of work in sufficient detail to ascertain the likelihood of a conflict with performance of this contract; and (4) discuss any conflicts that may arise from performance of the listed contracts and award of this contract.

12. For financial or other interests or relationships beyond Federal contracts or subcontracts that may give rise to an OCI, the Offeror shall (1) address the nature and extent of the interest(s) or relationship(s); (2) list any entity or entities involved in the interest(s) or relationship(s) and award of this contract.

13. The Offeror shall address how it will avoid, neutralize, or mitigate each potential OCI listed above. Sufficient information must be provided to allow a meaningful evaluation of the potential effect of the interest on the performance of the statement of work.

14. Include a requirement to update this plan as necessary to address specific OCIs. All updates to the plan must be approved by the contracting officer and the updates/changes must be incorporated in the contract to be effective.

15. Require periodic self-audits to ensure compliance with established OCI procedures/requirements/guidelines.

16. Define records related to the OCI plan (e.g., training and audit records) that will be made available to the Government upon request. Note: The OCI Plan as outlined in paragraphs 1 through 12 above is not for the purpose of addressing other very important contractual obligations such as (1) the contractor’s obligation to protect sensitive information in accordance with NFS 1852.237-72, Access to Sensitive Information, (2) the contractor’s obligation to conduct business in an ethical manner in accordance with FAR 52.203-13, contractor’s Code of Business Ethics and Conduct, and (3) the contractor’s obligation to prevent personal conflicts of interest in accordance with FAR 52.203-16, Preventing Personal Conflicts of Interest.

17. In an appendix to the OCI Plan identify the strategy (e.g., mitigation, limitation on future contracting, etc.) for resolving each OCI that is either identified in the solicitation or created by the requirements of the solicitation/contract and explain the effect of such strategy on performance of the contract. If using a firewall, explain how these actions will operate to successfully address the conflict without adversely affecting performance of the contract. (Note: Specific plans to limit future competition are reflected in the clause at NFS 1852.209-71, Limitation of Future Contracting.)

Maintenance: The contractor shall review the OCI Plan on an annual basis or as directed by the contracting officer to revise the OCI Plan if necessary. Revisions are subject to Contracting Officer approval and shall be incorporated by change page or complete reissue.

1. DRD Title: Contract Management Plan

2. DRD No.: 3 3. Data Type: 1 4. OPR: OSI

Administrative ☒

S&MA ☐

10. Description/Use: To document the Contractor's overall contract management approach and organization for accomplishing the contract requirements.

11. Distribution: Contract Specialist, Contracting Officer’s Representative and Deputy Contracting Officer’s Representative

Initial Submission: Preliminary draft of plan 30 calendar days after contract award.

Submission Frequency: Final 30 calendar days after effective date of contract. Submit revisions for Government approval after any major change in management organization and approach.

Format: Contractor format is acceptable

Interrelationship: PWS Section 2 Contract Mangement; PWS Attachment A EGSS Key Personnel Requirements

Applicable Documents: FAR 42.708, NFS 1842.708, NFS 1842.708-70

Scope: The Management Plan describes the contractor's summary concept plans, practices, and approach for accomplishing the requirements set forth in the contract, i.e., managing and controlling tasks and management interfaces. The plan shall be in such detail as necessary to convey the Contractor's internal procedures.

The Contract Management Plan shall include the following:

a. The contractor shall describe the overall proposed contract management approach, strategies, policies, processes for work planning, subcontractor management, and indirect cost management including any efficiencies proposed. This description shall include a description of the organizational structure and elements, including a chart depicting the organization and the overall rationale for this approach.

b. Describe the management relationships between the contractor’s key personnel and associated NASA personnel, including communication channels, lines of authority (including the line of succession if Program Manager is unavailable), reporting relationships, and responsibilities of all organizational elements. Include in this discussion any subcontractors, team members, or joint venture partners, to illustrate their relationships within the structure or between the organizational elements and any other subcontractors, team members, or joint venture partners. Describe the reporting responsibilities of the Program Manager to corporate management and the relationship between the Program Manager and the prime’s corporate management as well as the management of any subcontractors, team members, or joint venture partners. Describe the overall authority of the Program Manager to make decisions independent of corporate management.

c. Recruitment and employment methods and policies including any special provisions your company has regarding hiring incumbent employees. Strategy to ensure personnel will maintain the minimum qualification standards described in the Labor Category definitions.

d. Approach to providing flexible workforce planning. Include discussion on recruiting;

communication of promotion opportunities; retention of personnel; and the effects on management, subcontractors, continuity and quality of services, and other factors resulting from changes in staffing levels.

e. Describe the staffing location plans, including lease arrangements, for the contractor’s off-site facilities including a discussion of the on-site and off-site approach. Discuss any other issues related to logistics management.

f. A description of risks anticipated in successful performance of the PWS requirements. Include the decision to accept, mitigate, or other action for each risk and include the rationale for each.

g. The methods to ensure timely delivery of quality services. Describe how the contractor will ensure the Government will receive the services ordered by providing the method, level, and frequency of internal surveillance. Describe how the management policies, procedures, and techniques are monitored to ensure their effectiveness and facilitate continuous improvement.

Describe the methods of identifying deficiencies and plans for correcting deficiencies.

Describe the process for Management reviews/status reviews to NASA management.

h. Process for identification and resolution of as a minimum problems, issues, and weaknesses.

i. Process of setting goals and establishing policies, practices, procedures, and organizational structure to support accomplishment of EGSS objectives. At a minimum, this includes both transition and transformation management.

j. Discuss strategies/approach to ensure that the contractor can facilitate a proactive and efficient close out of the contract at contract end in as short a time as practicable including but not limited to possible use of the Quick Closeout procedures of FAR 42.708, Quick-closeout procedure, NFS 1842.708, Quick-closeout procedure, and NFS 1842.708-70, NASA Quick-closeout procedure. FAR 42.708, Quick-closeout procedures.

Maintenance: The Contractor may revise the CMP at any time or at the direction of the Contracting Officer. Revisions to the CMP are subject to Contracting Officer review and approval. Changes shall be incorporated as required by or complete reissue.

1. DRD Title: Contract Phase-In Plan

2. DRD No.: 4 3. Data Type: 1 4. OPR: OSI

Administrative ☒

S&MA ☐

10. Description/Use: To describe activities planned to transition from the processes and services as defined at contract start to those accepted by the Government during the proposal and contract award process.

11. Distribution: Contract Specialist, Contracting Officer’s Representative and Deputy Contracting Officer’s Representative

Initial Submission: Plan due 5 calendar days after notification of contract award.

Submission Frequency:. Revised for significant changes that may be required during the implementation of the specific changes in processes and services.

Format: Contractor format is acceptable

Interrelationship: PWS Section 2 Contract Mangement; PWS Attachment A EGSS Key Personnel Requirements

Applicable Documents: N/A

Scope: This plan defines tasks, schedule, responsibilities, and agreements for both the contractor and the Government, necessary to transition from the processes and services as defined at contract start to those accepted by the Government during the proposal and contract award process. The total time allocated for the implementation of the transition of processes and services shall not exceed 30 calendar days from phase-in start.

The Phase-in Plan shall address, as a minimum, the following:

a. Describe in detail the plan for maintaining continuous and efficient operations at NASA. Describe how you will work with incumbent Contractors and NASA, including resources and interfaces expected from each to ensure an effective transition and continuous service. The phase-in plan shall clearly demonstrate the Offeror’s ability to assume full contract responsibility on the contract’s effective date.

b. Provide a phase-in schedule which will accomplish all proposed phase-in steps/milestones within the 30-day phase-in period, while minimizing cost and maximizing efficiency. Include the personnel responsible for the steps/milestones.

Describe your approach for how you will implement the schedule.

c. Provide details for initial staffing and training of personnel, including the percentage of incumbent personnel that you plan to hire. Discuss proposed key personnel, if applicable and demonstrate that the key personnel are committed to employment prior to start of contract.

d. Address the office space that is required for phase-in, beyond what is to be provided by the Government, if any.

e. Describes how an inventory will be performed with the Incumbent Contractor(s) of all records that will be transitioned. Records transition shall be completed at contract start.

f. Describe your approach and risk mitigation strategies to identify any requirements for application or system connectivity or integration with NASA.

g. Address property control transfer, including schedule and milestones for completing 100% inventory including but not limited to Government Furnished Property and Installation Accountable Government Property.

h. Identify the risks associated with your plan and ways to mitigate those risks.

Maintenance: None

1. DRD Title: Monthly Performance Management Review Report

2. DRD No.: 5 3. Data Type: 1 4. OPR: OSI

6. Contract No.: (Insert contract number)

7. Date Issued: TBD 8. Date Revised: TBD 9. DRD Category:

Technical ☐ Administrative ☒

S&MA ☐

10. Description/Use: To provide the contractor’s status of major activities across all EGSS PWS areas

11. Distribution: Contract Specialist, Contracting Officer’s Representative, Deputy Contracting Officer’s Representative and as required by Task Orders.

Initial Submission: Submit online prior to initial EGSS Performance Management Review 30 days following the effective date of the contract.

Submission Frequency: Submit online 2 business days prior to each monthly EGSS Performance Management Review.

Format: The report shall be submitted in Microsoft Power Point format electronically. The presentation of this report should last no more than one and one-half hours.

Interrelationship: PWS 2.1 Project Management Support

Applicable Documents: None

Scope: The EGSS Monthly Performance Management Review Report provides the contractor’s status at the second level PWS.

Contents:

Monthly Status Report shall include, as a minimum, the following:

a. Major accomplishments

b. Efficiencies or innovations which depict a cost avoidance or cost/savings to the government

c. Problems and corrective actions taken

d. Indicate potential risks, their probability, impact, and proposed mitigation strategy

e. Personnel gains, losses and status

f. Government actions required

g. Summary of trips taken, conferences attended, etc.

Remarks: Monthly reports will be reviewed during EGSS Performance Management Reviews (PWS Section 2.1).

Maintenance: Revisions subject to COR approval.

1. DRD Title: Information Technology (IT) Security Management Plan

2. DRD No.: 6 3. Data Type: 1 4. OPR: OCIO

8. Date Revised: TBD

9. DRD Category:

Technical ☒ Administrative ☐

S&MA ☐

10. Description/Use: IT Security Management Plan In accordance with NFS 1852.204-76, Security Requirements for Unclassified Information Technology Resources.

11. Distribution: Contract Specialist, Contracting Officer’s Representative, Deputy Contracting Officer’s Representative, Center Information Technology Security Manager (CITSM), Information System Security Officer (ISSO)

Initial Submission: The contractor shall submit the IT Security Management Plan within 30 calendar days after award of contract. The approved plan will be incorporated into the contract as a compliance document.

Submission Frequency: The IT Security Management Plan shall be updated when referenced regulations are updated to address all required regulations and submitted on an annual basis as specified in paragraph one above for review and continued approval.

Format: Contractor’s format is acceptable as long as all requirements in the applicable documents are addressed.

Applicable Documents: NFS 1852.204-76. Specific guidance for contracts can be found in the following documents. These documents can be located at:

https://www.nasa.gov/content/cybersecurity-policies or https://csrc.nist.gov/publications/PubsSPs.html

a. Federal Information Security Management Act (FISMA)

b. NPD 1600.2, NASA Security Policy

c. NPD 2810.1, NASA Information Security Policy

d. NPR 1600.1, NASA Security Program Procedural Requirements

e. NPR 1620.2B, Facility Security Level Determinations

f. NPR 2810.1, Security of Information and Information Systems

g. NPR 2841.1, Identity, Credential, and Access Management

h. NIST Special Publication (SP) 800-35, Guide to IT Security Services https://csrc.nist.gov/publications/sp800.

Scope: The Contractor and any subcontractors that process, manage, access, transmit, or store unclassified electronic information, to include Controlled Unclassified Information (CUI), for NASA in support of NASA's missions, programs, projects and/or institutional requirements shall submit an IT Security Management Plan in accordance with NFS 1852.204-76, Security Requirements for Unclassified Information Technology Resources, for review and approval by the Center Information Technology Security Manager (CITSM), Information System Security Officer (ISSO), COR, D-COR and CO.

Contents: The IT Security Management Plan shall:

a. Identify how the requirements for IT security (including developing and maintaining IT system security plans, contingency plans, and performing information system security assessment).

b. Identify how the requirements for which NASA directives specifically mandate compliance with respect to security of NASA IT resources will be met.

c. Describe how the Contractor intends to hold its employees and subcontractors accountable for meeting all the requirements relative to the NPR 2810.1, NASA interim IT requirements (NITRs), IT Security Handbooks, and CIO directives.

The documents can be found at: https://www.nasa.gov/content/cybersecurity-policies

d. Describe how the Contractor will meet future or changing IT security requirements as directed by Federal Law or NASA requirements.

e. Describe how the Contractor plans to protect their corporate IT resources to ensure that they pose no adverse impact on NASA resources.

f. Describe how the Contractor will protect NASA or contract-specific information and data under their control.

g. Describe how the Contractor plans to provide documentation for any required IT security-related deliverable,

h. Describe how the Contractor will ensure compliance with all NASA IT security training and awareness requirements.

i. Describe how the Contractor will ensure compliance with NASA-established physical security requirements as they relate to IT security requirements.

j. Describe how the Contractor will ensure compliance with personnel screening requirements including assurance that employees with privileged access have the appropriate background screening.

k. Describe the Contractor’s procedures for termination of employees including assurance that all access privileges (e.g., network, remote access, virtual private network (VPN), campus computing, and other application access) are terminated.

l. State the Categorization of the information per FIPS PUB 199. Specific information on Categorization is available at NIST SP 800-60, Volume 1 Guide for Mapping Types of Information and Information Systems to Security Categories and NIST SP 800-60, Volume 2 Guide for Mapping Types of

Information and Information Systems to Security Categories: Appendices http://csrc.nist.gov/publications/PubsSPs.html.

Remarks:

Maintenance: The Contractor shall maintain the IT Security Management Plan throughout the term of the contract. Changes shall be incorporated by change page or complete reissue.

1. DRD Title: Contractor Mishap and Safety Statistics Reports

2. DRD No.: 7 3. Data Type: 3 4. OPR: OSMA

8. Date Revised: 9. DRD Category:

Administrative ☐

S&MA ☒

10. Description/Use: To provide information on mishaps and close calls affecting the Contractor’s safety and Health performance. The Contractor shall submit each Center’s specific Safety Statistics and Mishap Reporting data using JSC Form JF288.

11. Distribution: Contract Specialist, Contracting Officer’s Representative

Initial Submission: Due no later than 30 days after contract start.

a. Safety Statistics for the previous month shall be submitted by the time specified by the Center’s Safety Office.

1. Safety statistics shall be reported using the forms and processes specified by the Center’s Safety Office.

2. Safety statistics reports shall include the information specified by the Center’s Safety Office.

b. Initial reporting for Type A, Type B, and Type C that involves a lost time injury or illness, and any High-Visibility Close Calls for ALL contractors working onsite shall be reported to Center’s Safety Office as soon as possible after initiating emergency response, but no later than 1 hour of occurrence or awareness. For these types of mishaps, the initial notification can be made by calling the Center’s Safety Office then followed up within 24 hours with an entry into the NASA Mishap Information System (NMIS) by the contractor-designated NMIS representative.

c. Initial reporting for Type C that does not involve a lost time injury or illness, Type D, and Low-Visibility Close Calls for ALL contractors working onsite shall be reported to the Center’s Safety Office as soon as possible after initiating emergency response, but no later than 4 hours of occurrence or awareness by:

1. Calling the Center’s Safety Office or

2. Direct input into the NASA Mishap Information System by the contractor-designated NMIS representative. Access to NMIS database can be obtained from the specific NASA Center’s Safety Office after contract award.

d. Initial reporting for Type A and B mishaps and High-Visibility Close Calls for contractors working offsite shall be reported to Center’s Safety Office as soon as possible after initiating emergency response, but no later than 1 hour of occurrence or awareness by calling the Center’s Safety Office then followed up within 24 hours with an entry into the NASA Mishap Information System (NMIS) by the contractor-designated NMIS representative.

1. If a contractor employee has any type of mishap while visiting a NASA controlled site, they shall report immediately to their site sponsor in addition to other reporting requirements.

e. Initial reporting for Type C and D and Low-Visibility Close Calls for contractors working offsite shall be reported as specified by the Center’s Safety Office.

f. Initial reports for all mishaps and Close Calls shall provide as much information as possible, but at a minimum include the following: location and time of incident, number of fatalities, number hospitalized, Submission Frequency:

Safety Statistics: By the time specified by the Center’s Safety Office.

All Mishaps: Monthly Follow-up Corrective Action Plan/Status until corrective actions implemented and closure received by updating record in NMIS data base (preferred) or electronic submittal as specified by the Center’s Safety Office.

Format:; The Contractor shall submit each Center’s site-specific Mishap and safety statistics report using JSC Form JF288, “Statistical Information – Contractor Safety and Health Program”

Interrelationship: NFS 1852.223-73 Safety and Health Measures and Mishap Reporting

Applicable Documents: MCP 8621.1, SPLN-8621-0003; NPR 8621.1, MWI 8621.1, LPR

8621.1, JPR 8621.1, GPR-8621.4. KSC-PLN-2807

Scope: The Mishap and Safety Statistics Reports document all mishaps and close calls as required in NPR 8621.1 NASA Procedural Requirements for Mishap and Close Call Reporting, Investigating, and Recordkeeping.

Contents: The Mishap and Safety Statistics Reports shall contain the information required by NPR 8621.1 and as specified by the Center’s Safety Office.

Remarks:

DEFINITIONS

NASA Mishap. An unplanned event that results in at least one of the following:

a. Injury to non-NASA personnel, caused by NASA operations.

b. Damage to public or private property (including foreign property), caused by NASA operations or NASA-funded development or research projects.

c. Occupational injury or occupational illness to NASA personnel.

d. NASA mission failure before the scheduled completion of the planned primary mission.

e. Destruction of, or damage to, NASA property except for a malfunction or failure of component parts that are normally subject to fair wear and tear and have a fixed useful life that is less than the fixed useful life of the complete system or unit of equipment, provided that the following are true: 1) there was adequate preventative maintenance;

and 2) the malfunction or failure was the only damage, and the sole action is to replace or repair that component.

Close Call: An event in which there is no injury or only minor injury requiring first aid and/or no equipment or property damage, or minor equipment or property damage of less than $20,000, or not injury or only minor injury requiring first aid, but which possesses a potential to cause a mishap.

High Visibility (Mishaps or Close Calls): Those particular mishaps or close calls, regardless of the amount of property damage or personnel injury, that the Administrator, Chief/OSMA, CD, ED/OHO, or the Center SMA director judges to possess a high degree of programmatic impact or public, media, or political interest including, but not limited to, mishaps and close calls that impact flight hardware, flight software, or completion of critical mission milestones.

Type A Mishap: A mishap resulting in one or more of the following: (1) an occupational injury or illness resulting in a fatality or a permanent total disability; (2) a total direct cost of mission failure and property damage equal to or greater than $2 million ; (3) a crewed aircraft hull loss; (4) unexpected crewed aircraft departure from controlled flight (except high performance jet/test aircraft such as F-15, F-16, F/A-18, T-38, OV-10, and T-34, when engaged in flight test activities).

Type B Mishap: A mishap that caused an occupational injury or illness that resulted in a permanent partial disability or hospitalization for inpatient care of 3 or more people within 30 business days of the mishap, or a total direct cost of mission failure and property damage equal to or greater than $500,000 but less than $2,000,000.

Type C Mishap: A mishap resulting in a nonfatal occupational injury or illness that resulted in days away from work, not including the day or shift on which it occurred, or restricted work, or transfer to another job not including the day or shift on which it occurred, or hospitalization for inpatient care of one or two people within 30 business days of the mishap, or a total direct cost of mission failure and property damage Equal to or greater than $50,000 but less than $500,000.

Offsite: Location or facility not owned or controlled by NASA.

Onsite: Location or facility owned or controlled by NASA.

Maintenance: None

1. DRD Title: Safety and Health (S&H) Plan

2. DRD No.: 8 3. Data Type: 1 4. OPR: OSMA

8. Date Revised:

9. DRD Category:

Administrative ☐

S&MA ☒

10. Description/Use: To ensure the contract is conducted in a safe manner and complies with all safety and health directives, instructions, policies, and regulations listed in this contract. To verify the contractor intends to be proactive in safety and health practices.

OPR (OSMA – GE000): Upon receipt of the S&H Plan, the OPR will coordinate the review of the S&H Plan with the applicable Centers/locations to ensure compliance with the Agency and Center requirements. The OPR (OSMA point of contact) will coordinate with the Center’s SMA for the review of the S&H plan and to resolve comments prior to sending it back to the Contracting Officer.

11. Distribution: Contracting Officer

Initial Submission: The Contractor shall submit the S&H Plan no later than 45 days after contract award. The Contractor's S&H Plan shall address the Contract and include an annex/appendix describing unique safety hazards and their control for particular locations, as applicable based on the PWS.

Submission Frequency: The Contractor shall review the S&H Plan annually and by November 1 of each year, submit a letter stating the Plan remains current or submit an updated Plan as required.

Format: The Plan shall be structured according to CSP-03-01-005, OSHA Instruction, VPP Policies and Procedures Manual, Chapter 4.

Interrelationship: NFS 1852.223-73 Safety and Health Plan.

Applicable Documents: NPR 8715.1, NASA Occupational Safety and Health Programs; and CSP 03-01-005, OSHA Instruction, VPP Policies and Procedures Manual. Current revisions shall be used unless authorization to use obsolete revisions has been properly documented.

Scope: The S&H Plan shall describe tasks and activities of the S&H program at each location where the Contractor is operational to assure identification, evaluation, and elimination or control of S&H concerns.

Contents: At a minimum, the plan shall include:

a. All S&H Plan requirements specified in NPR 8715.1, NASA Occupational Safety and Health Programs, and Center specific regulations.

b. Organizational charts(s) illustrating the functional relationships and lines of communication between the S&H organization and other organizational elements, including all subcontracts.

c. Descriptions of the S&H management functions including the process through which management decisions will be made, notification to each location's (see “Distribution” section above) S&H organization of hazards, mishaps, and corrective actions.

d. Description of the responsibility, authority, and accountability of S&H personnel, other contractor organizational elements involved in the S&H, and subcontractor S&H personnel. Include the organizational unit responsible for the execution of S&H tasks and the position with the authority to resolve all identified S&H issues.

e. Description of the management controls that will be used to ensure compliance with S&H regulations.

f. Description of the S&H program measurement system, including safety metrics, and trend analysis methods. The performance measurement system should describe responsibility for identifying and implementing the measurement system.

g. Description of how the contractor S&H program requirements will be pass down to any subcontractor(s). Description how subcontractor(s) S&H compliance verification will be done.

h. A mishap contingency action plan that describes how support and services will continue in the event the contractor has a mishap.

i. Describe the safety analysis methodologies used to identify workplace hazards, the methods for developing mitigations, and the methods to implement the mitigations within the employees. This may be different for each location.

Remarks: OPR (OSMA – GE000): Upon receipt of the S&H Plan, the OPR will coordinate the review of the S&H Plan with the applicable Centers/locations to ensure compliance with the Agency and Center requirements. The OPR (OSMA point of contact) will coordinate with the Center’s SMA for the review of the S&H plan and to resolve comments prior to send it back to the Contracting Officer.

Maintenance: Changes shall be incorporated as required by change page(s) or complete reissue. Changes shall be identified with revision marks.