IAD Exhibit B Final 31Jan22.pdf

Exhibit B CONTRACT DOCUMENTATION REQUIREMENTS

I. Required Reports

A. Initial Baseline Financial Management Report (APPLICABLE TO CLIN 001 and

Applicable Options)

1. The Contractor shall prepare a time-phased Baseline Financial Management Report, detailing by month how it plans to incur costs for the base period of performance utilizing the NASA Form 533Q format. The Contractor shall prepare and submit the report in accordance with instructions set forth on the reverse side of the 533Q Form and NASA Procedural Requirements (NPR) 9501.2, NASA Contractor Financial Management Reporting. The Contractor shall submit the initial 533Q within 30 working days after the effective date of contract.

2. The Contractor shall submit a Baseline Financial Management Report for each option period within 30 working days after the effective date of the option period. The total estimated cost reflected in the reports must equal the contract value. The Contractor shall update the report, as required, during performance of the contract for approval by the Contracting Officer. The report shall be revised each time a contract modification is executed which increases or decreases the contract estimated cost, for a reason other than an overrun. The report shall not be revised to include overrun costs.

3. The minimum reporting categories indicated below shall be included in column 6 of this report.

a. Direct Labor Hours

b. Direct Labor Dollars

c. Overhead(s)

d. Subcontract

e. Material

f. Travel

g. Other Direct Cost

h. G&A

i. Total Estimated Cost

j. Fee

k. Total Estimated Cost and Fee

B. Monthly Contractor Financial Management Report (Applicable to Cost Type task orders)

1. The Contractor shall submit a Monthly Contractor Financial Management Report in accordance with NFS 1852.242-73, NASA Contractor Financial Management Reporting. The Contractor shall prepare and submit the form in accordance with the instructions set forth on the reverse side of the form and NASA Procedural Requirements (NPR) 9501.2, NASA Contractor Financial Management Reporting.

2. The Contractor shall submit a separate 533M for each authorized task order.

3. The Contractor shall submit a summary 533M covering all authorized task orders.

4. The Contractor shall submit the report not later than the 10th working day following the close of the Contractor's accounting period being reported.

5. The Contractor shall complete Columns 8.a and 8.b using estimates (forecasts) for the succeeding two months.

6. The Contractor shall ensure that estimates (forecasts) are the best projection of the actual costs to be reported in column 7.a of the subsequent month's 533M. Since NASA uses the Contractor's estimate for the current month (column 8.a of the 533M) as accrued costs in its monthly financial statements, the accuracy of these projections are critical to the integrity of NASA’s financial data.

7. The Contractor shall include a narrative explanation for variances exceeding plus or minus 10 percent (+/-10%) between estimated costs shown in the prior month and actual costs shown in the current month at the contract level. (For example, the estimated costs shown for June in column 8.a in the May 533M and the actual June costs shown in column 7.a in the June 533M.)

8. The Government will consider the Contractor’s accuracy of financial reporting when evaluating the Contractor’s performance in the Contractor Reporting Assessment Reporting System (CPARS).

9. The minimum reporting categories indicated below shall be included in column 6 of this report.

a. Direct Labor Hours

b. Direct Labor Dollars

c. Overhead(s)

d. Subcontract

e. Material

f. Travel

g. Other Direct Cost

h. G&A

i. Total Estimated Cost

j. Fee

k. Total Estimated Cost and Fee

C. Monthly Progress Report - The Contractor shall submit monthly progress reports for each task order describing work accomplished during the reporting period, current and potential problem areas and proposed corrective action, and work to be performed during the next reporting period. The Contractor may summarize all task order reports in one report, unless otherwise stipulated in individual task orders. The Contractor shall submit the monthly progress report within 10 working days after the end of each calendar monthly report period.

A monthly report shall not be required for the period in which the final report is due.

D. Final Reports - Each task order may require the Contractor to submit a final report, either formal or informal which documents and summarizes the results. The requirement for a final report will be identified in the individual task order. When a formal final Contractor report is required, the Contractor shall submit it in accordance with the instructions contained in NFS 1852.235-73, Final Scientific and Technical Reports.

E. Information Technology (IT) Security Management Plan

1. When the Contractor is being provided Government-furnished IT equipment as stated in

1852.245-71 Installation-Accountable Government Property, the Contractor shall submit an IT Security Management Plan in accordance with NFS 1852.204-76, Security Requirements for Unclassified Information Technology Resources, within 30 calendar days after contract award for review and approval by the Center Information Security Officer (CISO). All IT Security Management Plans requiring CISO review and approval shall be sent to: larc-dl-ciso-review@mail.nasa.gov.

2. The Contractor shall maintain the IT Security Management Plan throughout the term of the contract. The Contractor’s plan shall:

a. Identify how the requirements for IT security (including developing and maintaining IT system security plans, contingency plans, and performing information system security assessment) will be met.

b. Identify how the requirements, for which NASA directives specifically mandate compliance with respect to security of NASA IT resources, will be met.

c. Describe how the Contractor intends to hold its employees and subcontractors accountable for meeting all the requirements relative to the NPR 2810.1, “ Security of Information Technology”, IT Security Handbooks, and CIO directives. The documents can be found at: https://cset.nasa.gov/ascs/cspd-handbooks/.

d. Describe how the Contractor will meet future or changing IT security requirements as directed by Federal Law or NASA requirements.

e. Describe how the Contractor plans to protect its corporate IT resources to ensure that they pose no adverse impact on NASA resources.

f. Describe how the Contractor will protect NASA or contract-specific information and data under its control.

g. Describe how the Contractor plans to provide documentation for any required IT security-related deliverable.

h. Describe how the Contractor will ensure compliance with all NASA Cybersecurity training and awareness requirements.

i. Describe how the Contractor will ensure compliance with NASA-established physical security requirements as they relate to IT security requirements.

j. Describe how the Contractor will ensure compliance with personnel screening requirements including assurance that employees with privileged access have the appropriate background screening; this includes a proper Tier II background investigation successfully adjudicated if access to sensitive or higher data and systems is required.

k. Describe the Contractor’s procedures for termination of employees including assurance that all access privileges (e.g., network, remote access, virtual private network (VPN), campus computing, and other application access) are terminated.

l. State the Categorization of the information per FIPS PUB 199. Specific information on Categorization is available at NIST SP 800-60 Volume 1 Guide for Mapping Types of Information and Information Systems to Security Categories and NIST SP800-60 Volume 2 Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices http://csrc.nist.gov/publications/PubsSPs.html.

3. The IT Security Management Plan shall be continuously updated to address all required regulations and submitted on an annual basis to LaRC OCIO for review and continued approval.

4. Specific guidance for contracts can be found in the following documents. These documents can be located at http://www.nasa.gov/offices/ocio/itsecurity/index.html or http://csrc.nist.gov/publications/PubsSPs.html

a. Federal Information Security Management Act (FISMA) https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma

b. NPD 1600.2, NASA Security Policy

c. NPD 2810.1, NASA Information Security Policy

d. NPR 1600.1, NASA Security Program Procedural Requirements

e. NPR 2810.1, Security of Information Technology

f. NIST Special Publication (SP) 800-35, Guide to IT Security Services

g. LAPD 2810.1 Security of Information Technology

h. IT-HBK-2841-002 Identity, Credential, and Access Management (ICAM) Handbook)

F. Information Technology (IT) Security Plan (External Systems Security Plan)-

1. The Contractor shall submit an IT Security Plan in accordance with NFS 1852.204-76, Security Requirements for Unclassified Information Technology Resources, for Contracting Officer approval no later than 60 calendar days after contract award date.

2. In order for the Contractor to access NASA IT Systems; manage, process, and store NASA

Data and; use private Contractor-owned and operated IT Systems (as approved by NASA) and obtain a NASA “Authorization to Process” and access to NASA VPN, the Contractor’s IT Security Plan (External Systems Security Plan) shall be compliant with FISMA requirements based on NIST SP 800-53 “Security and Privacy Controls for Information Systems and Organizations, or NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. In addition, the Contractor shall provide evidence of a satisfactory independent assessment of the submitted IT Security Plan.

Until NASA grants an Authorization to Process, Contractors with an approved IT Security Management Plan may be able to access NASA IT Systems provided as Installation Accountable Government Property.

3. Specific guidance for contracts can be found in the following documents. These documents can be located at http://www.nasa.gov/offices/ocio/itsecurity/index.html and https://www.nasa.gov/content/security-requirements-policies.

a. Federal Information Security Management Act (FISMA) https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma

b. NPD 1600.2, NASA Security Policy

c. NPD 2810.1, NASA Information Security Policy

d. NPR 1600.1, NASA Security Program Procedural Requirements

e. NPR 2810.1, Security of Information Technology

f. NIST Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems

g. NIST Special Publication (SP) 800-35, Guide to IT Security Services

h. NIST SP800-60 Volumes 1 Guide for Mapping Types of Information and

Information Systems to Security Categories

i. NIST SP800-60 Volume 2 Guide for Mapping Types of Information and

Information Systems to Security Categories: Appendices

j. NIST SP 800-53 Security and Privacy Controls for Information Systems and

Organizations OR NIST SP 800-171 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

k. NIST SP 800-64, Security Considerations in the Information System Development Life Cycle

l. LAPD 2810.1 Security of Information Technology

m. ITS-HBK-2810.02-05, Security Assessment and Authorization: External

Information Systems

n. IT-HBK-2841-002 Identity, Credential, and Access Management (ICAM)

Handbook)

G. NASA Property in the Custody of Contractors

1. The Contractor shall submit annually a NASA Form (NF) 1018, NASA Property in the

Custody of Contractors, in accordance with NFS 1852.245-73, Financial Reporting of NASA Property in the Custody of Contractors. The Contractor shall comply with the instructions on the Form, NFS 1845.71, and any supplemental instructions for the current reporting period issued by NASA.

2. Subcontractor use of NF 1018 is not required by this clause; however, the Contractor shall include data on property in the possession of subcontractors in the annual NF 1018.

3. The Contractor shall submit the NF 1018 no later than October 31st of each year for the period October 1 through September 30 of the following year.

4. A final report shall be submitted within 30 calendar days after disposition of all property when contract performance is complete.

H. ISO 9001 Compliance Documents Applicable for Track A and B. Track C at the task order level.

1. Within fourteen calendar days after the contract award date, the Contractor shall submit a copy of its Quality Plan and its Quality System Manual. The Contractor shall also submit the specific Quality System Procedures to address the following: (a) contract and subcontract management; (b) customer requirement review and execution; (c) task management, including work order generation and processing; (d) document control; (e) handling of customer supplied product; (f) corrective, preventive, and continuing improvement action systems; (g) training of employees; (h) customer satisfaction/performance measurement; and

(i) design control.

2. The Quality Plan shall describe how the Contractor will maintain or modify existing quality system documentation needed to ensure effective planning, operation, and control of processes/work activities/resources specific to accomplish the requirements of this contract. The Contractor shall describe how the integrity of the Quality Management System (QMS) is maintained when changes to the QMS are planned and implemented.

3. The Quality System Manual shall describe the quality management system of an organization. The quality manuals can vary in detail and format to suit the size and complexity of an individual organization.

I. Employment Reports on Veterans - The Contractor shall submit a Veterans’ Employment

Report (VETS-4212 Report) as required by Clause 52.222-37, Employment Reports on Veterans. Within 30 calendar days following the VETS-4212 Report submission, the Contractor shall submit a letter to the Contracting Officer confirming that it has submitted the most recent annual VETS-4212 Report required by FAR 52.222.37.

J. Evidence of Insurance - The Contractor shall submit evidence of the insurance coverage required by NFS 1852.228-75 Minimum Insurance Coverage (i.e., a Certificate of Insurance or other confirmation) to the Contracting Officer prior to performing under this contract. The Contractor shall also present such evidence to the Contracting Officer prior to commencement of performance under any options exercised, if applicable.

K. Small Business/Nonprofit 1852.227-70 New Technology Reporting (Contracts with Task Orders)

Interim New Technology Summary Report - The Contractor shall submit an annual list of subject inventions required to be disclosed as set forth in FAR 52.227-11, Patent Rights- Ownership by the Contractor (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor). The annual list of inventions shall be provided for each Task Order and include applicable Task Order information. The Contractor may submit the Interim New Technology Summary Report through the e-NTR New Technology Reporting System website at https://invention.nasa.gov/.

Final New Technology Summary Report –The Contractor shall submit a listing of all subject inventions required to be disclosed, or certify that there were none, as set forth in FAR 52.227-11 Patent Rights- Ownership by the Contractor (as modified by NFS 1852.227- 11, Patent Rights-Ownership by the Contractor). The annual list of inventions shall be provided for each Task Order and include applicable Task Order information. This report is due within 3 months after completion of the contracted work. The Contractor may submit the Final New Technology Summary Report through the e-NTR New Technology Reporting System website at https://invention.nasa.gov/.

Disclosure of Invention - The Contractor shall disclose each subject invention under the contract as set forth in FAR 52.227-11, Patent Rights-Ownership by the Contractor, (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor). NASA prefers that the contractor use the e-NTR New Technology Reporting System website at https://invention.nasa.gov/ for this reporting. The contractor may also utilize the paper version of NASA Form 1679. Disclosures are required within two months after the inventor discloses it in writing to Contractor personnel who are responsible for patent matters.

L. Large Business 1852.227-70 Reporting (Contracts with Task Orders)

Interim New Technology Summary Report – The Contractor shall submit an annual list of reportable items, certify that all reportable items have been disclosed (or that there are no such items), and certify that the procedures required by paragraph (e) (1) of NFS 1852.227- 70, New Technology, have been followed. The Contractor shall submit the Interim New Technology Summary Report through the e-NTR New Technology Reporting System website at https://invention.nasa.gov/.

Final New Technology Summary Report – In accordance with NFS 1852.227-70 New Technology, the Contractor shall submit a Final New Technology Report listing all reportable items or certifying that there were no such reportable items and listing all subcontracts at any tier containing a patent rights clause or certifying that there were no such subcontracts. This report is due within 3 months after completion of the contracted work.

The Contractor shall submit the Final New Technology Summary Report through the e-NTR New Technology Reporting System website at https://invention.nasa.gov/.

Task Order Interim New Technology Summary Report - The Contractor shall submit an annual list per Task Order of reportable items required to be disclosed as set forth in NFS 1852.227-70, New Technology. The Contractor shall submit the Task Order Level Interim

New Technology Summary Report (See Section J “New Technology Summary Report Template”) to LaRC-New-Technology@mail.nasa.gov.

Task Order Final New Technology Summary Report –The Contractor shall submit a listing per Task Order of all reportable items required to be disclosed or certify that there were none as set forth in NFS 1852.227-70, New Technology. This report is due within 3 months after completion of the task order work. The Contractor shall submit the Task Order Level Interim New Technology Summary Report (See Section J “New Technology Summary Report Template”) to LaRC-New-Technology@mail.nasa.gov.

Disclosure of New Technology - The Contractor shall disclose each reportable item under the contract as set forth in NFS 1852.227-70, New Technology. NASA prefers that the contractor use e-NTR New Technology Reporting System website at https://invention.nasa.gov/ for this reporting. The contractor may also utilize the paper version of NASA Form 1679. Disclosures of New Technology are required within two months after the inventor discloses it in writing to Contractor personnel who are responsible for administration of this New Technology.

M. Organizational Conflicts of Interest (OCI) and Personal Conflicts of Interest (COI) Avoidance Plan If Applicable at the individual task order level.

1. The Contractor shall provide a plan for complying with the requirements of Section H.3, Organizational Conflicts of Interest. The Contractor shall explain its approach to identifying, mitigating, and/or avoiding OCIs (and if FAR 52.203-16 is included in the contract, personal COIs) that may arise under this contract. The Contractor shall include, at a minimum: (i) an assessment of the potential risk for various types of conflicts such as access to sensitive, non-public information; (ii) the Contractor’s process for identifying OCIs, including the Contractor’s coordination with each of its parent, subsidiaries, affiliates, office locations, divisions, and/or other similar entities (collectively, the “Business Units”) to determine whether OCIs currently exist; (iii) the approach for maintaining communication with each Business Unit during the performance of this contract to identify potential OCIs arising during such performance period; (iv) the approach to training and refresher training for its employees; (v) once identified, the methods the Contractor will utilize to mitigate the various types of OCIs; and, if applicable; (vi) the Contractor’s approach for identifying, mitigating, and/or avoiding personal COIs for “covered employees” performing acquisition functions closely associated with inherently governmental functions under the contract.

2. The plan and subsequent revisions will be reviewed and approved by the Contracting

Officer, in consultation with the Office of General Counsel. The approved plan will be incorporated into the contract as a compliance document once approved.

N. Subcontracting Reports (Applicable for other than Small Businesses)

1. The Contractor shall submit all subcontracting reports in accordance with FAR 52.219-9 and NFS 1852.219-75, using the Electronic Subcontract Reporting System (eSRS). Access to eSRS can be found at: http://www.esrs.gov/

2. The Contractor shall notify the Contracting Officer in writing within 5 business days of its eSRS submission.

II. DOCUMENT DISTRIBUTION REQUIREMENTS

1. Unless otherwise specified elsewhere in this contract, the Contractor shall submit reports and other documentation f.o.b. destination as specified below, addressed as follows:

National Aeronautics and Space Administration Langley Research Center, Attn: Keith Johnson, r.k.johnson@nasa.gov Copy to Karen Dempster, Karen.C.Dempster@Nasa.gov Contract (insert number) Hampton, VA 23681-2199

2. The following letter codes designate the recipients of reports and other documentation which are required to be delivered prepaid to Langley Research Center by the Contractor:

NOTE TO SPECIALIST: For ease in using this table, you may delete the recipient and insert “Not Applicable” next to any Letter which is not used in your contract.

A - Contract Specialist, Karen.C.Dempster@Nasa.gov

B - Contracting Officer’s Representative, r.k.johnson@nasa.gov

C – LaRC Center Software Assurance Manager, leslie.j.johnson@nasa.gov. Mark as “Contract CMMI Appraisal Results” or “Contract Software Management Plan”

D - Financial Management, LaRC-DL-NF533@mail.nasa.gov

E - Safety and Facility Assurance Branch, Mail Stop 305 or fax 757-864-8918 or CMAR http://cmar.larc.nasa.gov/login.cfm

F - RESERVED

G - Financial Management, NF 1018 Electronic Submission System (NESS)

H - Patent Counsel at https://invention.nasa.gov or NF 1679 submission to LaRC-New- Technology@mail.nasa.gov

I - Industrial Property Officer, bushra.k.ebneof@nasa.gov

J - RESERVED

K - Center Information Security Officer (CISO) kendall.e.freeman@nasa.gov;

kim.elliott@nasa.gov

L - According to instructions on form

M - As required by Task Order

N - Task Monitor

O - Safety and Mission Assurance Office, Mission Assurance Branch donald.j.porter@nasa.gov

P – Langley STI Manager, greta.m.lowe@nasa.gov

Q - On and Near-Site Staffing Report, larc-dl-contractorwye@mail.nasa.gov with “Contractor WYE” in subject line

R - Environmental Management Office (EMO), ingrid.a.carlberg@nasa.gov

S – New Technology Administrator, LaRC-New-Technology@mail.nasa.gov

3. The following are the distribution requirements for reports and other documentation required to be delivered f.o.b. destination. The numeral following the letter code specifying the number of copies to be provided:

LETTER CODE AND DOCUMENT DISTRIBUTION

Financial Management Report (NASA Forms 533M & 533Q): A-1, B- 1, D-1

Monthly Progress Report: A-1, B-#, M

Final Report: A-1; (P-1 copy of the transmittal letter that forwarded report to the CO and other distribution of the transmittal letter as specified in NFS 1852.235-73)

Informal Final Report: A-1, B-1

IT Security Plan (External Systems Security): A-1, B-1, K-1

Report of Property in the Custody of Contractors (NASA Form 1018): G-1, I-1, L

Transferring Property to Government (DD Form 1149): I-1

ISO 9001 Compliance Documents: A-1, B-1, O-1

Veterans Employment Report (VETS-4212): A-1, L

Evidence of Insurance: A-1

Small Business/Nonprofit 1852.227-70 New Technology Reporting (Contracts with Task Orders) : A-1, B-1, H-1, S-1

Large Business 1852.227-70 Reporting (Contracts with Task Orders) : A-1, B-1, H-1, S-1

OCI Avoidance Plan (and Personal Conflict of Interest): A-1, B -1, M

Subcontracting Report for Individual Contracts (Standard Form 294): http://www.esrs.gov/

Summary Subcontractor Report (Standard Form 295): http://www.esrs.gov/

4. When the Contract Specialist (A) is not designated above to receive a copy of a report or document, the Contractor shall furnish a copy of the report/document transmittal letter to the Contract Specialist. If delegated, the Contractor shall also furnish a copy of the transmittal letter and a copy of each Financial Management Report to the delegated Administrative Contracting Officer of the cognizant DoD (or other agency) contract administrative services component.