ATTACHMENT_K_-_IT_Security_Applicable_Documents_List.pdf

ATTACHMENT K

INFORMATION TECHNOLOGY (IT) SECURITY

APPLICABLE DOCUMENTS LIST

RFP NNG16544506R

Attachment K

NNG16544506R

(07/2015)

Information Technology (IT) Security Applicable Documents List July 2015

NASA Policy Directives (NPD) and NASA Procedural Requirements (NPR) Document Subject Effective Date

NPR 1382.1A NASA Privacy Procedural Requirements 7/10/2013 NPD1382.17H NASA Privacy Policy 6/24/2009 NPD 1440.6I NASA Records Management 9/10/2014 NPR 1441.1E NASA Records Management Program Requirements 1/29/2015 NPD 2540.1G Personal Use of Government Office Equipment Including Information Technology 6/8/2010 NPD 2800.1B Managing Information Technology 3/21/2008 NPR 2800.1B Managing Information Technology 3/20/2009 NPD 2810.1D NASA Information Security Policy 5/9/2009 NPR 2810.1A Security of Information Technology w/ Change 1, May 19, 2011) 5/16/2006 NPD 2830.1A NASA Enterprise Architecture 11/2/2011 NPR 2830.1A NASA Enterprise Architecture Procedures 12/19/2013 NPR 2841.1 Identity, Credential, and Access Management 1/6/2011

NASA Interim Directive (NID) Document Subject Effective Date

NM2810-64 NASA Interim Directive: Information Technology Security and Efficiency Requirements 5/22/2008

NID 7120.99 NASA Information Technology and Institutional Infrastructure Program and Project Management Requirements 12/22/2011

NASA Interim Technical Requirements (NITR) Document Subject Effective Date

NITR 2800_2 Email Services and Email Forwarding 9/18/2009 NITR 2800_1 NASA Information Technology Waiver Requirements and Procedures 8/13/2009

IT Security Handbooks (ITS-HBK) Document Subject Effective Date

ITS-HBK-1382.02-01 Privacy Goals and Objectives 7/27/2012 ITS-HBK-1382.03-01 Privacy Risk Management and Compliance: PIAs and SORNs 9/25/2012

ITS-HBK-1382.03-02 Privacy Risk Management and Compliance: Annual Reporting Procedures for Reviewing and Reducing PII and Eliminating the Unnecessary Use of SSN 9/7/2011

ITS-HBK-1382.04-01 Privacy and Information Security: Overview 8/28/2012 ITS-HBK-1382.05-01 Privacy Incident Response and Management: Breach Response Team Checklist 9/25/2012

ITS-HBK-1382.06-01 Privacy Notice and Redress: Web Privacy & Written Notice, Complaints, Access and Redress 9/7/2012

ITS-HBK-1382.07-01 Privacy Awareness and Training: Overview 9/7/2014

IT Security Handbooks (ITS-HBK) Document Subject Effective Date

ITS-HBK-1382.08-01 Privacy Accountability: Overview 8/28/2012 ITS-HBK-1382.09-01 Privacy Rules of Behavior and Consequences: Overview 9/7/2012 ITS-HBK-2810.0001-B Format and Procedures for an IT Security Policies and Handbooks 6/19/2014 NITR 2810.1 NASA Information Technology Security Disclaimer 9/30/2014 ITS-HBK-1441.01.01 Records Retention and Disposition: Overview 7/2/2014 ITS-HBK-1440.01.01 Records Planning & Management: Records 7/2/2014 ITS-HBK-2841.001-A Identity, Credential, and Access Management Services 2/1/2011 IT-SOP-2841.001-A Identity and Credential Service Providers Federation Requests 2/1/2011

IT-SOP-2841.002-A Identity, Credential, and Access Management (ICAM): Service Deviation Requests Management & Records Life Cycle-Overview 2/1/2011

IT-STD-1441.1 NASA Records Retention Schedules 5/7/2014 ITS-HBK-2810.02-01 Security Assessment and Authorization 5/6/2011 ITS-HBK-2810.0002-A Roles and Responsibilities Crosswalk & Definitions 5/2/2013 ITS-HBK-2810.02-02D Information System Security Assessment and Authorization Process 2/1/2015

ITS-HBK-2810.02-04A Security Assessment and Authorization: Continuous Monitoring – Annual Security Control Assessments 3/18/2014

ITS-HBK-2810.02-05 Security Assessment and Authorization: External Information Systems 10/24/2012

ITS-HBK-2810.02-06 Security Assessment and Authorization: Extending and Information Systems Authorization to Operate Process and Templates 10/24/2012

ITS-HBK-2810.02-08A Security Assessment and Authorization: Plan of Action and Milestones (POA&M) 12/11/2013 ITS-HBK-2810.03-01 Planning 5/6/2011

ITS-HBK-2810.03-02 Planning: Information System Security Plan Template, Requirements, Guidance and Examples 2/9/2011

ITS-HBK-2810.04-01A Risk Assessment: Security Categorization, Risk Assessment, Vulnerability Scanning, Expedited Patching & Organizationally Defined Values 10/12/2012

ITS-HBK-2810.04-02 Risk Assessment: Procedures for Information System Security Penetration Testing and Rules of Engagement 4/30/2013

ITS-HBK-2810.04-03 Risk Assessment: Web Application Security Program 4/30/2013 ITS-HBK-2810.05-01 Systems and Service Acquisition 11/21/2011 ITS-HBK-2810.06a-01 Awareness and Training 5/5/2011 ITS-HBK-2810.07-01 Configuration Management 5/6/2011 ITS-HBK-2810.08-01 Contingency Planning 5/6/2011

ITS-HBK-2810.08-02 Contingency Planning: Guidance and Templates for Plan Development, Maintenance and Test 2/10/2011

ITS-HBK-2810.09-01A Incident Response and Management 12/30/2014 ITS-HBK-2810.09-02 NASA Information Security Incident Management 8/24/2011 ITS-HBK-2810.09-03 Targeted Collection of Electronic Data 8/24/2011 ITS-HBK-2810.09-04 Incident Response and Management: Guidelines for Data Spillage & Sanitization Procedures 2/27/2014 ITS-HBK-2810.10-01 Maintenance 5/6/2011 ITS-HBK-2810.11-01 Media Protection 7/13/2012 ITS-HBK-2810.11-02 Media Protection: Digital Media Sanitization 7/13/2012 ITS-HBK-2810.12-01 Physical and Environmental Protection 5/6/2011 ITS-HBK-2810.13-01 Personnel Security 5/6/2011 ITS-HBK-2810.14-01 System and Information Integrity 5/6/2011 ITS-HBK-2810.15-01 Access Control 9/4/2012 ITS-HBK-2810.15-02A Access Control: Elevated Privileges (EP) 9/20/2012 ITS-HBK-2810.16-01 Audit and Accountability 5/6/2011 ITS-HBK-2810.17-01 Identification and Authentication 1/17/2011 ITS-HBK-2810.18-01 System and Communications Protection 4/6/2011

Standards

Document Subject Effective Date

EA-STD 0001.0 Standard for Integrating Applications into the NASA Access Management, Authentication, and Authorization Infrastructure 8/1/2008

EA-SOP 0003.0 Procedures for Submitting a NASA Agency Forest (NAF) Deviation Request and Transition Plan 8/1/2008

EA-SOP 0004.0 Procedures for Submitting an Application Integration Deviation Request and Transition Plan 8/1/2008 NASA-STD-2804-P Minimum Interoperability Software Suite 9/22/2014 NASA-STD-2805-P Minimum Hardware Configurations 9/22/2014

MEMORANDA

From To Subject Effective Date Posted Date

(Acting) Senior Agency Information Security Officer

Center/Mission Directorate Chief Information Officer (CIO), Chief Information Security Officers (CISO), and Information System Owners (ISO)

Vulnerabilities in Unsupported or End of Life Software 5/28/2015 5/28/2015

(Acting) Senior Agency Information Security Officer Distribution Naming Pattern Memo 5/28/2015 5/28/2015

Office of the Chief Information Officer

(Acting) Senior Agency Information Security Officer

Expired Policy 2810-02.05 Security Assessment and Authorization: External Information Systems

11/19/2014 11/19/2014

Senior Agency Information Security Official (Acting) Distribution

Interim Guidance for Leveraging Cloud Services While Meeting Information Security Requirements

1/28/2015 1/28/2015

Valerie Burks Center/Mission Directorate CIOs Configuration Guidance for Computer Operating Systems 12/17/2012 12/17/2012

(Acting) Senior Agency Information Security Officer Office of the CISO Extension Verification 2810-02.05 11/19/2014 11/19/2014

NASA CIO and Deputy CIO for IT Security Distribution Updated Password Requirements for AA

Accounts 7/2/2014 7/2/2014

Chief Information Officer Distribution Establishment and Maintenance of Secure Communications 2/28/2014 2/28/2014

Deputy Chief Information Officer for Information Technology Security

Distribution Implementation of National Institute of Standards and Technology Special Publication 800-53, Revision 4

12/19/2013 12/19/2013

Chief Information Officer Distribution Minimum Security Requirements for Personal Mobile Devices 8/27/2013 8/27/2013

Chief Information Officer Distribution

Additional 90-day extension: Blanket waiver for use of Filevault 2.0 to meet Data at Rest (DAR) Encryption Requirements

5/7/2013 5/7/2013

Office of the Chief Information Officer Distribution

Delegation of Authorizing Official Designation to Center and Mission Directorate Chief Information Officers

4/2/2013 4/2/2013

Deputy CIO for Information Security Distribution

NASA ACES Secure Virtual Team Meeting (SVTM) Approved for Secure Meetings and Communication of SBU Data

2/5/2013 2/5/2013

Chief Information Officer Distribution

Cancellation of PDM 2012-064 Data At Rest (DAR) Waiver Process and issuance of a new PDM addressing Alternate DAR Encryption Products

1/27/2013 1/27/2013

Deputy CIO for Information Technology Security

Center Mission Directorate Chief Information Officers (CIO)

Configuration Guidance for Computer Operating Systems 12/17/2012 12/17/2012

Associate Deputy Administrator All NASA Employees

Breach of Personally Identifiable Information (PII) [Laptop DAR/Encryption]

11/13/2012 11/13/2012

Chief Information Officer All NASA Center CIO's Rescinding and/or Archiving Information Technology (IT) Security Memoranda 9/20/2012 9/20/2012

Deputy CIO for Information Security All NASA Center CIOs FY2012 FISMA Awareness and Training

Reporting Metrics 9/12/2012 9/12/2012

OCIO Distribution Acceptance of other Federal IT Security Awareness Training to Satisfy NASA's FISMA Requirements

5/25/2012 5/25/2012

From To Subject Effective Date Posted Date Charles F. Bolden, Jr., NASA Administrator All NASA Employees Protection of Sensitive Agency

Information 4/3/2012 4/3/2012

Assistant Administrator for Security and Program Protection, Chief Information Officer (Acting)

NASA Center Directors Identity, Credential, and Access Management Business Process Leads 8/27/2009 8/27/2009

Chief Information Officer (Acting)

Officials-in-Charge of Headquarters, Center CIOs, Mission Directorate CIOs

Security and Support Policy for Smartphones 8/3/2009 8/3/2009

Chief Information Officer (Acting) Center CIOs

Delegation of Waiver Authority and Responsibility for Vulnerability Scanning Requirements

5/6/2009 5/6/2009

Chief Information Officer (Acting)

Officials-in-Charge of Headquarters Offices, NASA Center Directors

Roles and Responsibilities for Protecting NASA Sensitive But Unclassified (SBU) Information

4/27/2009 4/27/2009

Deputy CIO for IT Security Center CIOs, Center ITSMs FY 2009 Scanning and Vulnerability Elimination or Mitigation 2/06/2009 2/06/2009

Chief Information Officer Officials-in-Charge of Headquarters Offices, NASA Center Directors

Personally Identifiable Information (PII) Incident Reporting 1/14/2009 1/14/2009

Chief Information Officer All NASA Civil Service and Contractor Employees

Policy for Use of Removable Media, Such as USB Thumb Drives 11/21/2008 11/21/2008

Senior Agency Official for Privacy

Official-in-Charge of Headquarters Offices, NASA Center Directors

Personally Identifiable Information (PII) Responsibilities Statement 9/8/2008 9/8/2008

Chief Information Officer Center CIOs Deployment of the Software Refresh Portal 7/30/2008 7/30/2008

Chief Information Officer NASA CIOs, Mission Directorate CIOs, Center ITSMs, Center Human Resources Directors, IEMP

Requirement to Log and Verify Sensitive Data Extracts 6/9/2008 6/9/2008

Chief Information Officer

NASA CIOs, Mission Directorate CIOs, Center ITSMs, Center ITSMs, Center Human Resources Directors, IEMP

Remote Access to Personally Identifiable Information (PII) 6/9/2008 6/9/2008

Deputy CIO for IT Security Center ITSMs Clarification on Requirement for Contractors to Complete NASA Annual IT Security Awareness Training

6/6/2008 6/6/2008

Deputy CIO for IT Security Center CIOs, Center ITSMs System Security Documentation in RMS 2/20/2008 2/20/2008 Chief Information Officer Center CIOs, Deputy CIOs Information Discovery 2/4/2008 2/4/2008

Deputy CIO for IT Security Center CIOs, Center ITSMs Decision to Cancel Procurement Information Circular (PIC) 04-03 (System Administrator Certification Program)

1/16/2008 1/16/2008

Chief Information Officer Official-in-Charge of Headquarters Offices, NASA Center Directors

Release of NPD 2200.1A, Management of NASA Scientific and Technical Information

12/18/2007 12/18/2007

Deputy CIO for IT Security Center CIOs, Mission Directorate CIOs

Agency Security Configuration Standards:

Federal Desktop Core Configurations 11/15/2007 11/15/2007

Chief Information Officer Center Chief Information Officers Designation of FIPS-199 Impact Level for NASA's OAIT Voice Systems 7/10/2007 7/10/2007

Chief Information Officer Center Chief Information Officers Designation of FIPS-199 Impact Level for NASA OAIT Data Center Systems 7/10/2007 7/10/2007

Chief Information Officer Center Chief Information Officers Designation of FIPS-199 Impact Level for NASA OAIT LANs 7/10/2007 7/10/2007

From To Subject Effective Date Posted Date

Chief Information Officer (Acting)

Center CIOs, Mission Directorate CIOs

Meeting OMB Memoranda M-06-015 "Safeguarding Personally Identifiable Information;" M-06-016 "Protection of Sensitive Agency Information," and M-06- 019 "Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments"

10/17/2006 10/17/2006

Deputy Administrator Administrator/Official-in-Charge of Headquarters Offices, NASA Center Directors

Meeting NASA Information Technology Security Requirements 7/26/2006 7/26/2006

Deputy CIO for IT Security Center CIOs Designation of FIPS-199 Impact Level for NASA OAIT Desktop Systems 4/16/06 4/16/06

Chief Information Officer, Chief of Strategic Communications

Official-in-Charge of Headquarters Offices, NASA Center Directors, Center CIOs, Mission Directorate CIOs

Policy Governing NASA's Publicly Accessible Web sites 3/16/2006 3/16/2006

Chief Information Officer, Assistant Administrator of Public Affairs

Center CIOs Update of NASA Web site Linking Policy 12/15/2005 12/15/2005

Chief Information Officer Center CIOs Update of NASA Web site Privacy Policy 11/28/2005 11/28/2005

Reminder: Within 30 days after contract effective date, the Contractor shall develop and deliver an IT Security Management Plan to the Contracting Officer for approval.