Draft Data Requirements Description (DRD)_JSHIFT20250213.pdf

February 2025

Exhibit B

Data Requirements Documents (DRDs) for

Joint Safety Health Institutional Facilities Team (JSHIFT)

A. INTRODUCTION

This Data Requirements Document (hereinafter called (DRD) is the contract document that shall govern all Data Requirement Deliverables (DRD) required by and for the Joint Safety Health Institutional Facilities Team (JSHIFT) contract. The Contractor shall furnish all DRDs described in this document.

Except as otherwise provided in this contract, the cost/price of data to be furnished in response to any DRD is included in the total price of this contract and shall be reimbursed in accordance with the terms and conditions of the contract.

Task Orders will indicate which DRDs from this Exhibit B are to be submitted and may also include additional deliverables as described in the order and shall be delivered in accordance with the requirements of this Exhibit B and the order.

B. DOCUMENT PREPARATION AND DELIVERY

All DRDs prescribed in this Exhibit shall be numbered with the contract number, DRD Number, submittal date required, and period covered by the DRD (all days are calendar days unless otherwise stated). Successive issues or revisions of documents shall be identified in the same manner as the basic issue and shall include appropriate change identification such as Rev. 1, etc.

All DRDs shall be prepared, maintained, and delivered to NASA in accordance with the DRD unless otherwise required in specific DRDs. If specific DRDs require delivery in other than electronic format, printing shall be completed in the most economical method commensurate with the size of the report and its intended use (e.g., double sided, black and white).

C. DRD TYPE DESCRIPTION

Type 1 – All issues and interim changes to those issues require written approval from the Contracting Officer or designee before formal release for use or implementation (e.g.

Organizational Conflict of Interest Plan).

Type 2 - NASA reserves a time-limited right to disapprove in writing any issues and interim changes to those issues. The contractor shall submit the required DRD to NASA for review not less than 45 calendar days prior to its release for use. The contractor shall clearly identify the release target date. If the data is unacceptable, NASA will notify the contractor within 45 calendar days from the date of submission, regardless of the intended release date. The contractor shall resubmit the information for reevaluation if disapproved. The submittal is considered approved if the contractor does not receive disapproval or an extension request from NASA within 45 calendar days (e.g. Government Property Plan).

Type 3 - These data shall be delivered by the contractor as required by the contract and do not require NASA approval. However, to be a satisfactory delivery, the data shall satisfy all applicable contractual requirements and be submitted on time (e.g. Financial Management Plan (533M)).

D. DRD CATEGORY

Administrative – This category is for requirements that are business related (e.g., 533 Monthly Reporting, Organizational Conflict of Interest Plan, Diversity, Equity, Inclusion and Accessibility Plan, etc.).

Technical – This category is for requirements that are completely technical in nature (e.g., drawings, EEE parts list, data handling & software system analysis, etc.)

S&MA – This category is for requirements that are related to safety and mission assurance (e.g., Safety and Health Plan, Quality Assurance Surveillance Plan, etc.)

E. DRD LISTING

DR # DR Title Center(s) 1 Contract Management Plan All 2 Quality Control Plan All 3 Safety and Health Plan All 4 OCI Avoidance Plan All 5 Security Requirements for Unclassified IT Resources All 6 Evidence of Insurance All 7 Conformable Wage Rate Agreement All 8 Monthly Progress Report All 9 Initial Baseline Monthly Financial Management Report – CLIN 0004 All 10 Monthly Contractor Financial Management Report – CLIN 0004 All 11 On and Near-Site Staffing Report All 12 Annual IT Security Training Requirements Report All 13 EPA-Designated Categories Annual Purchasing Report All 14 Biobased Products Report All 15 Employment Report on Veterans All 16 Mishap Statistics All 17 JSC Morning Report JSC 18 Fire Systems Inspection, Testing, and Maintenance (ITM) Completion

Report

JSC

1. DRD Title: Contract Management Plan (CMP)

2. DRD No.: 1 3. Data Type: 1 4. OPR: OP

5. Solicitation No.: 80LARC25R7001

6. Contract No.: TBD

7. Date Issued: TBD

8. Date Revised: N/A 9. DRD Category:

Technical ☐ Administrative ☒

S&MA ☐

10. Description/Use: Document the Contractor’s overall and detailed planning and operations for successfully accomplishing the contract requirements.

11. Distribution: Contracting Officer and Contracting Officer’s Representative(s)

Initial Submission: No later than 15 days after contract award.

Submission Frequency: As needed.

Format: Contractor format is acceptable. The electronic format shall be compatible with MS Office products.

Interrelationship: N/A

Applicable Documents: N/A

Scope: The CMP shall be an umbrella document, which encompasses and integrates all contract management activities necessary to successfully accomplish the contract requirements. The CMP shall provide a comprehensive integration of all management systems of the prime and subcontractors. The plan shall include those processes specifically required to accomplish the Statement of Work (SOW), as well as those systems and procedures that are to be set in place by the Contractor to adhere to regulations and requirements set forth in the solicitation and the resulting contract.

Contents: The CMP shall cover, but not be limited to the following:

1. The contractor shall describe the overall proposed contract management approach, strategies, policies, processes for work planning, subcontractor management, and indirect cost management including any efficiencies proposed.

2. Provide a description of the organizational structure and elements, including a chart depicting the organization and the overall rationale for this approach.

3. Provide functional personnel descriptions of each position on the contract to include roles, responsibilities, and qualifications.

4. Describe the management relationships between the Program Manager and associated NASA personnel, including communication channels, lines of authority (including the line of succession if Program Manager is unavailable), reporting relationships, and responsibilities of all organizational elements.

5. Describe the reporting responsibilities of the Program Manager to corporate management and the relationship between the Program Manager and the prime’s corporate management, as well as the management of any subcontractors, team members, or joint venture partners. Describe the overall authority of the Program Manager to make decisions independent of corporate management.

6. Provide a description of risks anticipated in successful performance of the SOW requirements. Include the decision to accept, mitigate, or other action for each risk and include the rationale for each.

7. Describe the process for the coordination and execution of all contracts’ technical and administrative tasks, and how the contractor’s technical personnel (individuals and line managers) will interact with NASA line management and contractors.

8. Describe how the contractor will ensure the Government will receive the services ordered by providing the method, level and frequency of internal surveillance.

9. Describe how the management policies, procedures, and techniques are monitored to ensure their effectiveness and facilitate continuous improvement.

10. Describe the methods of identifying deficiencies and plans for correcting deficiencies.

11. Describe the process for Management reviews/status reviews to NASA management.

12. Provide the “Work Breakdown Structure” (WBS) that shows all the products and services required to achieve all the requirements of this contract. Sub-divide the WBS into the work to be accomplished in elements that serve as the basis for detailed planning and control and permit the collection of cost and schedule data for each element. Format the WBS as a tree structure composed of all the work required by the contract SOW.

13. Attach a dictionary to provide a concise description of contract tasks to be performed and products to be delivered, subdivided by WBS elements. A WBS element may represent an identifiable product, a set of data, a service, a task, or a budget function. Lower levels of detail, which the contractor uses for its own management purposes to validate information reported to NASA, shall be compatible with NASA requirements and be accessible to NASA. The relationship between the WBS and the contractor’s internal organizations and processes should also be provided.

14. Provide the methodology to manage resources to meet changing center safety priorities.

15. Describe training requirements for contract personnel and approach to maintaining a qualified workforce. Describe training, qualification, and certification program and methods to measure effectiveness of this approach and methods for managing and measuring personnel attrition and minimizing impact to contract performance.

16. Provide management approach and methods for complying with Center Risk Management Processes.

17. Method and schedule for providing reports required in the DRL and include additional reports proposed by the Contractor.

18. Describe the system for planning, tracking, accumulating, and reporting contract costs and providing other financial support required to meet the budgeting, cost reporting, billing, and disclosure documents of the contract. Include any interrelationships with financial reporting requirements contained in DRD 02, Contractor Financial Management Report (533).

19. Describe the approach and method to ensure IT security to include planning and personnel training required by NPR 2810.1, Security of Information Technology.

20. Provide any other significant management details that will affect performance of the contract. This may include items such as subcontract relationships, teaming relationships, partnership agreements, vendor agreements, interface agreements with parties external to this contract, and other resources which may be made available to support contract performance.

Remarks: None.

Maintenance: Submit revisions for Government approval after any major change in management organization and approach.

1. DRD Title: Quality Management Plan

2. DRD No.: 2 3. Data Type: 1 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use:

The Quality Management Plan is used to document the details of the contractor's specific product or process to manage this contract across the three (3) Centers.

11. Distribution: Contracting Officer and Contracting Officer’s Representative(s)

Initial Submission: Submit initial copy 30 days after contract start and updates as required.

Submission Frequency: Revisions shall be submitted within 45 days after major changes as determined by the Contracting Officer.

Format: Contractor’s format is acceptable if all requirements in the applicable documents is addressed.

Interrelationship: Statement of Work (SOW) 1.0 Introduction and Scope

Applicable Documents: JPD 1280.1 - JSC Quality Policy, JPR 1280.2 - JSC Quality Manual

Scope: A contract specific Quality Management Plan shall identify management activities performed at all Center’s sites/locations applicable to this contract to ensure quality products and services in accordance with the

SOW.

Contents: The quality management plan shall delineate the strategic framework used by the company operating across the Centers, aiming to coordinate operations, set consistent goals, and adapt to local differences while maintaining a unified vision across all locations and ensuring a cohesive approach to management practices. The quality management plan shall address elements (plan/do/check/acts) of the ISO9001/QMS or local quality management policies/standard to describe how requirements will be implemented for this contract; and the requirements identified below.

a) Identify work instructions needed for the contract to ensure quality products and services. This may include work instructions currently on the Center’s processes/procedure and other work instructions that will be internal to the contract.

b) Identify the methods, procedures, and controls the company will use to ensure the quality, and timeliness of the activities as described in sections of the Statement of Work (SOW).

c) Explain how you verify that all personnel performing work affecting product quality are competent as a result of appropriate education, training, skills, and experience. In addition, explain the system you will use to monitor and maintain this level of personnel competency required during the duration of the contract.

d) Describe your responsibilities and requirements for planning and conducting audits (internal and external), and for reporting results and maintaining records.

Remarks: N/A

Maintenance: Changes shall be incorporated as required by change page(s) or complete reissue. Changes shall be identified with revision marks.

1. DRD Title: Safety and Health Plan

2. DRD No.: 3 3. Data Type: 1 4. OPR: LaRC SMAO

Administrative ☐

S&MA ☒

10. Description/Use: To ensure the contract is conducted in a safe manner and complies with all safety and health directives, instructions, policies, and regulations listed in this contract. To verify the contractor intends to be proactive in safety and health practices.

Upon receipt of the S&H Plan, the OPR will coordinate the review of the S&H Plan with the applicable Centers/locations to ensure compliance with the Agency and Center requirements. The OPR (OSMA point of contact) will coordinate with the Center’s SMA for the review of the S&H plan and to resolve comments prior to send it back to the Contracting Officer.

11. Distribution: Contracting Officer, Contracting Officer’s Representative, and Center Safety Offices.

Initial Submission: The Contractor shall submit the S&H Plan no later than 30 days after contract award.

The Contractor's S&H Plan shall address the Base portion of the Contract and include an annex/appendix describing unique safety hazards and their control for particular locations, as applicable based on the PWS.

The Contractor shall submit the S&H plan, initial and updates, to the

Submission Frequency: The Contractor shall review the S&H Plan annually and by November 1 of each year, submit a letter stating the Plan remains current or submit an updated Plan as required.

Format: The Plan shall be structured according to CSP-03-01-005, OSHA Instruction, VPP Policies and Procedures Manual, Chapter 4.

Interrelationship: 1852.223-70, Safety and Health; 1822.223-73, Safety and Health Plan

Applicable Documents: NPR 8715.1, NASA Occupational Safety and Health Programs; and CSP 03-01- 005, OSHA Instruction, VPP Policies and Procedures Manual. Current revisions shall be used unless authorization to use obsolete revisions has been properly documented. JPR 1700.1, LPR 1740.2, and GPR 1700.1.

Scope: The S&H Plan shall describe tasks and activities of the S&H program at each location where the Contractor is operational to assure identification, evaluation, and elimination or control of S&H hazards.

Contents: At a minimum, the plan shall include:

a. All S&H Plan requirements specified in NFS 1852.223-73 Safety and Health Plan; NPR 8715.1, NASA Occupational Safety and Health Programs, and Center specific regulations.

b. Organizational charts(s) illustrating the functional relationships and lines of communication between the S&H organization and other organizational elements, including all subcontracts.

c. Descriptions of the S&H management functions including the process through which management decisions will be made, notification to each location's (see “Distribution” section above) S&H organization of hazards, mishaps, and corrective actions.

d. Description of the responsibility, authority, and accountability of S&H personnel, other contractor organizational elements involved in the S&H, and subcontractor S&H personnel. Include the organizational unit responsible for the execution of S&H tasks and the position with the authority to resolve all identified S&H issues.

e. Description of the management controls that will be used to ensure compliance with S&H regulations.

f. Description of the S&H program measurement system, including safety metrics, and trend analysis methods. The performance measurement system should describe responsibility for identifying and implementing the measurement system.

g. Description of how the contractor S&H program requirements will be pass down to any subcontractor(s). Description how subcontractor(s) S&H compliance verification will be done.

h. A mishap contingency action plan that describes how support and services will continue in the event the contractor has a mishap.

i. Describe the safety analysis methodologies used to identify workplace hazards, the methods for developing mitigations, and the methods to implement the mitigations within the employees. This may be different for each location.

j. Identify any significant S&H hazards posed by the specific tasks under the contract and controls implemented to protect personnel (employees and other personnel), Center facilities, equipment, and the public.

Maintenance: Changes shall be incorporated as required by change page(s) or complete reissue. Changes shall be identified with revision marks.

1. DRD Title: Organizational Conflicts of Interest (OCI) Plan

2. DRD No.: 4 3. Data Type: 1 4.OPR: OP

8. Date Revised: TBD 9. DRD Category:

Administrative ☒

S&MA ☐

10. Description/Use: The Plan will communicate the contractor’s approach to identify and resolve OCIs.

The contractor will be held accountable for identifying, dispositioning, and reporting OCIs during contract performance.

11. Distribution: Distribution shall be as instructed by the contracting officer.

Initial Submission: Plan shall be submitted within 15 days of contract award.

Submission Frequency: As needed.

Format: Contractor’s format is acceptable. The electronic format shall be compatible with Microsoft Office.

Interrelationship: NASA Federal Acquisition Regulation (FAR) Supplement (NFS) 1852.209-71, Limitation of Future Contracting, NFS 1852.237-72, Access to Sensitive Information, NFS 1852.237-73, Release of Sensitive Information.

Applicable Documents: FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, NFS 1809.500, NASA Guide on Organizational Conflicts of Interest.

Scope: The OCI Plan describes the contractor’s comprehensive approach to identify, avoid, mitigate, neutralize, and report potential OCI issues, including conflicts described in the solicitation and those discovered during contract performance.

Contents: The OCI Plan shall meet the requirements of FAR 9.5 and include the following:

1. Point of contact for OCI issues and reports.

2. Demonstrate an understanding of (1) OCI principles and (2) the full breadth of OCI issues and the types of harm that can result. The Plan at a minimum addresses the three primary types of OCIs (i.e., biased ground rules, unequal access to information, and impaired objectivity).

3. Define company roles, responsibilities, and procedures for (1) screening (i.e., identifying/recognizing, analyzing/evaluating, resolving, and reporting) existing and new business opportunities for actual/potential OCIs and (2) monitoring and reporting all potential/actual OCIs that arise, resolving conflicts, and reporting previously unidentified OCIs or potential OCIs to the Government.

4. Describe how employees are notified of the Plan’s requirements and how this notification will be documented. Establish and require entrance training for new employees, refresher training for existing employees, and exit training for departing employees. Describe how completion of this training will be documented, including a copy of any training certification template that the contractor will use to document that its employees have completed training.

5. Describe how the contractor will report breaches of the protective measures in the Plan to the contracting officer. Describe what processes the contractor will implement following any breach and indicate that final resolution of the corrective action must be approved by the contracting officer.

6. Identify any affiliated companies/entities (e.g., a parent company or a wholly owned subsidiary) and procedures for coordinating OCIs with such affiliated companies/entities.

7. Address the process for reporting all potential/actual OCIs that arise during performance of the contract. An OCI report shall include (1) a description of the conflict, (2) the plan for resolving the conflict, and (3) the benefits/risks to contract performance associated with plan approval/acceptance.

Specific resolution strategies shall be appended to the Plan upon approval by the Government.

8. Explain how the contractor will flow down the provisions of this Plan to any subcontractor that may have a conflict with regard to performing the requirements of this contract. Discuss affected subcontractors’ OCI program as it relates to this contract and specifically explain how affected subcontractors will identify, resolve, and report actual/potential OCIs associated with this contract.

9. Define organizational and employee sanctions for violations of established OCI procedures/requirements/guidelines.

10. Include an assertion from the Offeror that to the best of its knowledge no OCIs exist currently, if applicable. Provide a list of all the prime’s and proposed subcontractor(s)’s NASA contracts and subcontracts currently being performed and contracts performed within the last five years of the release of this solicitation, in order to provide the CO a better understanding of other NASA work performed by the Offeror that may give rise to an actual or potential conflict. For each prime contract and subcontract listed, the Offeror shall: (1) identify the contract number; (2) describe the scope of work in sufficient detail to ascertain the likelihood of a conflict with performance of this contract; and (3) discuss any conflicts that may arise from performance of the listed contracts and award of this contract.

11. The Offeror shall also list any non-NASA Federal contracts and subcontracts that it or its proposed subcontractors are currently performing or have performed in the five years preceding the release of the solicitation that may give rise to an OCI. For each and subcontract listed, the Offeror shall: (1) identify the contract by number and name; (2) identify the name, address and contact information of the customer(s); (3) describe the scope of work in sufficient detail to ascertain the likelihood of a conflict with performance of this contract; and (4) discuss any conflicts that may arise from performance of the listed contracts and award of this contract.

12. For financial or other interests or relationships beyond Federal contracts or subcontracts that may give rise to an OCI, the Offeror shall (1) address the nature and extent of the interest(s) or relationship(s); (2) list any entity or entities involved in the interest(s) or relationship(s) and award of this contract.

13. The Offeror shall address how it will avoid, neutralize, or mitigate each potential OCI listed above.

Sufficient information must be provided to allow a meaningful evaluation of the potential effect of the interest on the performance of the statement of work.

14. Include a requirement to update this plan as necessary to address specific OCIs. All updates to the plan must be approved by the contracting officer and the updates/changes must be incorporated in the contract to be effective.

15. Require periodic self-audits to ensure compliance with established OCI procedures/requirements/guidelines.

16. Define records related to the OCI plan (e.g., training and audit records) that will be made available to the Government upon request. Note: The OCI Plan as outlined in paragraphs 1 through 12 above is not for the purpose of addressing other very important contractual obligations such as (1) the contractor’s obligation to protect sensitive information in accordance with NFS 1852.237-72, Access to Sensitive Information, (2) the contractor’s obligation to conduct business in an ethical manner in accordance with FAR 52.203-13, contractor’s Code of Business Ethics and Conduct, and (3) the contractor’s obligation to prevent personal conflicts of interest in accordance with FAR 52.203-16, Preventing Personal Conflicts of Interest.

17. In an appendix to the OCI Plan identify the strategy (e.g., mitigation, limitation on future contracting, etc.) for resolving each OCI that is either identified in the solicitation or created by the requirements of the solicitation/contract and explain the effect of such strategy on performance of the contract. If using a firewall, explain how these actions will operate to successfully address the conflict without adversely affecting performance of the contract. (Note: Specific plans to limit future competition are reflected in the clause at NFS 1852.209-71, Limitation of Future Contracting.)

Maintenance: The contractor shall review the OCI Plan on an annual basis or as directed by the contracting officer to revise the OCI Plan if necessary. Revisions are subject to Contracting Officer approval and shall be incorporated by change page or complete reissue.

1. DRD Title: Security Requirements for Unclassified IT Resources

2. DRD No.: 5 3. Data Type: 1 4. OPR: OCIO

Technical ☒ Administrative ☐

S&MA ☐

10. Description/Use: To ensure that IT security reporting requirements, including Cyber Supply Chain Risk Management (C-SCRM), are met for all IT systems utilized during work associated with this contract and necessary training requirements are fulfilled.

11. Distribution: All deliverables required by this DRD, except for the C-SCRM plan, shall be submitted electronically to the CO, COR, and NASA Organization’s Information System Security Officer (ISSO) (i.e., Security Officer). Approval will be provided by the ISSO. If the organization does not have an ISSO, approval will be provided by the NASA Information Owner. C-SCRM plans shall be submitted to and approved by the ICT/C-SCRM Service Element Lead at agency-dl-ocio-cys-cp-scrm@mail.nasa.gov.

Initial Submission: Information System Security and C-SCRM Plan(s): For contractor-owned systems, due at the start of phase-in. Initial submission not required for existing, approved plans for Government-owned and Contractor-managed systems. For new Federal Information Systems, due with the delivery of the system.

Non-Federal System Certification: Prior to any transfer of NASA non-public information to the contractor, the contractor shall provide documentation of the certification of the non-federal system to the security officer of the NASA organization that owns the information (typically the organization responsible for the contract). If the organization does not have an ISSO, the attestation shall be provided to the NASA Information Owner.

- Information on Employees in Sensitive Positions/Assignments Report: At the start of phase-in

- IT Security Point of Contact: At the start of phase-in

- IT Security Awareness Training: Training required prior to access to NASA information and systems.

- IT Security Role Based Training: Foundational training is provided prior to performance of assigned role. Initial evidence showing completion due at the end of phase-in

Submission Frequency:

- Information System Security Plan(s) and C-SCRM Plan: As Required

- Non-Federal System Certification: Annually

- Information on Employees in Sensitive Positions/Assignments Report: Annually

- IT Security Point of Contact: As Required

- IT Security Awareness Training: Annual on anniversary date of initial training

- IT Security Role Based Training: Annual on anniversary date of initial training. Evidence of completion due annually.

Format: Unless otherwise directed, the data requested in this DRD shall be delivered to the Government in soft-copy via an electronic transfer mechanism (e.g., electronic mail, flash drive, or file transfer protocol) in a format readable by a Government device utilizing the standards in NASA-STD-2804, “Minimum Interoperability Software Suite.”

Interrelationship: 1852.204-76, Security Requirements for Unclassified IT Resources.

mailto:agency-dl-ocio-cys-cp-scrm@mail.nasa.gov

Applicable Documents: Most current versions of the following:

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems FAR 52.204–29, Federal Acquisition Supply Chain Security Act Orders-Representation and Disclosures FISMA 2014, Federal Information Security Modernization Act 2014 NFS 1852.204-76, Security Requirements for Unclassified IT Resources NFS 1852.223-75, Major Breach of Safety or Security NFS 1852.237-72, Access to Sensitive Information FS 1852.237-73, Release of Sensitive Information NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations NPR 1382.1, NASA Privacy Procedural Requirements NPD 2810.1, Information Security Policy NPR 2810.1, Security of Information and Information Systems NPR 2810.7, Controlled Unclassified Information NPR 7120.7, NASA Information Technology Program and Project Management Requirements OMB Circular A-130, Management of Federal Information Resources

Scope: All contracts that purchase, lease, network to, or otherwise utilize covered articles, which includes Government-funded IT (as defined by the FAR) must comply with NASA IT Security and C-SCRM Requirements.

Contents: The Federal Information Security Modernization Act (FISMA) and Executive Branch policy require external providers that process, store, or transmit federal information or operate information systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies.

Information System Security Plan (i.e., System Security Plan, IT Security Plan, or Security Plan): When the contractor is operating a Federal Information System (FIS) on behalf of NASA or is providing a FIS in the execution of this contract, that system must have an Information System Security Plan in accordance with NIST Special Publication (SP) 800-53, “Security and Privacy Controls for Information Systems and Organizations” at the revision number required at the issuance of the contract. This plan and supporting documents shall be entered into the NASA cybersecurity system of record pursuant to Authorization to Operate (ATO) requirements set forth in NASA Policy Directive 2810.1, “NASA Information Security Policy” and NASA Procedural Requirement (NPR) 2810.1, “Security of Information and Information Systems.” The FIS security plan and ATO must be in place before any system may operate in the NASA environment.

Non-Federal System Security Certification When the contractor will receive, process, store or transmit NASA non-public information, especially Controlled Unclassified Information (CUI) including Personally Identifiable Information (PII) on a non-federal system (e.g., the contractor’s corporate system) the system must meet the requirements for data protections detailed in NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”

This documentation may take the form of:

a. A third-party review/audit certifying that the non-federal system meets the requirements of NIST SP 800-171 or equivalent standard of information protection, such as the ISO 27001 standard.

b. A certification from another federal agency such as the DOD Cybersecurity Maturity Model Certification (CMMC) Level 2.

Incident Notification The contractor shall report immediately upon notification any incident involving NASA information on nonfederal (contractor) systems to SOC@nasa.gov.

IT Security Point of Contact The contractor shall identify a point of contact that NASA may reach in its attempt to address IT and cybersecurity issues. The point of contact shall have the authority to ensure the immediate notification of the NASA Security Operations Center of any incident involving NASA information.

IT Security Awareness Training Contractor employees subject to this contract, defined as those requiring physical access to NASA facilities or electronic access to NASA systems, shall complete the NASA approved IT Security Awareness Training annually. NASA Cybersecurity and Privacy Awareness training is available through the SATERN online system and must be completed prior to access to NASA information and systems. Completion of the training is tracked automatedly by NASA and must recur each year by the anniversary of the initial training as a condition of continued access. Cybersecurity and Privacy training is updated throughout the year as needed, so there is no defined training period.

IT Security Role Based Training Contractor employees subject to this contract shall complete NASA’s Foundational IT Security Training in SATERN related to the following role-based functions prior to performing the role:

• IT Security Manager

• Information System Owner (ISO)

• Information System Security Officer (ISSO)

• Information System Security Engineer (ISSE)

It is highly recommended, but not required, that Contractor employees complete advanced role-based training every other year following completion of the initial training provided by NASA. This training is also provided by NASA but may be fulfilled externally. If fulfilled externally, the Contractor shall provide the “External Role-Based Training Validation Form” to the center CISO. The process for completing this form and receiving credit may be found at: External RBT Validation Form (sharepoint.com).

Information On Employees In Sensitive Position(S)/Assignments Report The Information on Employees is Sensitive. IT Security (ITS) Positions/Assignments Report shall provide information annually for personnel screening as required by NPR 2810.1(series), and NPR 1600.1 on position risk.

Cyber Supply Chain Risk Management (C-SCRM) Plan NIST defines C-SCRM as a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, process, and procedures. A C-SCRM plan, consistent with the recommended template in NIST SP 800-161, Section 3.1 shall be delivered prior to the processing, transmission, or storage of non-public NASA information in performance of the contract.

Remarks: None.

Maintenance: Information System Security Plan(s) shall be kept up to date as changes to the baseline mailto:SOC@nasa.gov configuration of the system(s) occur.

Non-Federal System Certifications shall be maintained annually or per the certifying body’s standard.

Information on Employees in Sensitive Positions/Assignments Report shall be maintained annually.

IT Security Point of Contact shall be kept up to date as changes occur.

Evidence of completion of IT Security Role Based Training is due annually.

C-SCRM plans shall be kept up to date as changes occur to organizational C-SCRM processes, policies, and procedures, and/or, new components are introduced.

1. DRD Title: Evidence of Insurance

2. DRD No.: 6 3. Data Type: 1 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use: Evidence of the insurance coverage required by NFS 1852.228-75, Minimum Insurance Coverage (i.e., a Certificate of Insurance or other confirmation).

11. Distribution: Contracting Officer

Initial Submission: Prior to commencement of performance under the contract.

Submission Frequency: Prior to commencement of performance under any options exercised.

Format: Certificate of Insurance or other confirmation

Interrelationship: 1852.228-75 Minimum Insurance Coverage

Applicable Documents: None.

Scope: The Contractor shall submit evidence of the insurance coverage required by NFS 1852.228-75 Minimum Insurance Coverage (i.e., a Certificate of Insurance or other confirmation) to the Contracting Officer

Contents: N/A

Maintenance: The contractor shall notify NASA within 2 business days of any changes to insurance.

1. DRD Title: Conformable Wage Rate Agreement

2. DRD No.: 7 3. Data Type: 1 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use: Conformable Wage Rate Agreement in accordance with FAR 52.222-41, Service Contract Labor Standards

11. Distribution: Contracting Officer, Contracting Officer’s Representative

Initial Submission: Within 15 working days after the award date of the contract.

Submission Frequency: No later than 30 calendar days after a change.

Format: Contractor’s format is acceptable if all requirement in the applicable documents is addressed.

Interrelationship: 52.222-41, Service Contract Act of 1965

Applicable Documents: N/A

Scope: For individuals employed by the Contractor who are covered by the Service Contract Act but are not listed in the applicable Collective Bargaining Agreement(s) or the Register of Wage Determinations and Fringe Benefits (WD), the Contractor shall submit a report that verifies their conformable wage rate agreement as addressed in FAR 52.222-41, Service Contract Labor Standards.

Contents: N/A

Maintenance: Changes shall be incorporated by change page or complete reissue.

1. DRD Title: Monthly Progress Report

2. DRD No.: 8 3. Data Type: 3 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use: The report provides a summary of contract performance, service delivery, and update of key metrics at each center for the period of performance.

11. Distribution: Contracting Officer, Contracting Officer’s Representative(s), others as requested by the Contracting Officer.

Initial Submission: Within 10 business days following the first calendar month of performance.

Submission Frequency: Monthly, within 10 business days following the calendar month of performance.

Format: The Contractor’s format for the base monthly progress report is acceptable. Required Center specific reporting information is detailed below.

LaRC and GSFC

- Occupational Safety o Summary of services delivered o List of design and jobs safety analysis reviews o Inspections completed (e.g., construction, OSET, building, laboratory) o Safety training courses provided o Incident response activities o Facility Safety Assessments o Management/administrative meeting support o Program statistics

- Industrial Hygiene o Emergency response activities o Surveys and assessments completed (e.g., IAQ, IH baseline and follow-up, LEV, ergonomics, ODH) o Respiratory protection statistics o Hearing conservation activities o Personal protective equipment consultation services o Asbestos program support and sample locations o Food safety reports o IH equipment and lab coordination activities (including sample statistics) o Chemical reviews o Safety training courses provided o Management/administrative meeting support o Program statistics

- Radiation Protection o Emergency response o Radioactive source inventories, monitoring, and approvals o Radioactive source shipping, waste disposal, and decontamination activities o Non-ionizing radiation source approvals, inventories, and inspections o Other support o Program statistics

Interrelationship: N/A

Applicable Documents: N/A

Scope: Provides a status report, summary of services, and update of key metrics of services delivered per the SOW for each of the Centers.

Contents: N/A

Maintenance: Changes shall be incorporated by complete reissue.

1. DRD Title: Initial Baseline Financial Management Report – CPFF CLIN 0004

2. DRD No.: 9 3. Data Type: 1 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use: The Contractor shall prepare a time-phased Baseline Financial Management Report, detailing by month how it plans to incur costs for the base period of performance utilizing the NASA Form 533M format.

11. Distribution: Contracting Officer; Contracting Officer’s Representative, and Financial Management LaRC-DL-NF533@mail.nasa.gov.

Initial Submission: 30 calendar days after the effective date of the task.

Submission Frequency: Initial submission, and annually 30 calendar days after the effective date of each option period.

Format: NASA Form 533M

Interrelationship: The Contractor shall prepare a time-phased Baseline Financial Management Report, detailing by month how it plans to incur costs for the base period of performance utilizing the NASA Form 533Q format. The Contractor shall prepare and submit the report in accordance with instructions set forth on the reverse side of the 533M Form and NASA Procedural Requirements (NPR) 9501.2E, NASA Contractor Financial Management Reporting.

Applicable Documents: NASA Procedural Requirements (NPR) 9501.2, NASA Contractor Financial Management Reporting.

Scope: The Contractor shall submit a Baseline Financial Management Report for each option period within 30 working days after the effective date of the option period. The total estimated cost reflected in the reports must equal the contract value unless otherwise directed by the Contracting Officer (e.g., to reflect the Annual Service Plan). The Contractor shall update the report, as required, during performance of the contract for approval by the Contracting Officer. The report shall be revised each time a contract modification is executed which increases or decreases the contract estimated cost, for a reason other than an overrun. The report shall not be revised to include overrun costs.

Contents: The minimum reporting categories indicated below shall be included in column 6 of this report.

mailto:LaRC-DL-NF533@mail.nasa.gov

Remarks: The data contained in the reports shall be auditable using Generally Accepted Accounting Principles.

Maintenance: The report will be updated for each option and with each contract modification.

Hours:

Direct Labor Hours (Prime) Direct Labor Hours (Significant Subcontractor) Breakdown by significant subcontractor Total Direct Labor Hours Overtime Hours (Prime) Overtime Hours (Significant Subcontractor) Breakdown by significant subcontractor Total Overtime Hours

Total Direct and Overtime Hours Labor Cost:

Direct Labor Cost (Prime) Overtime Labor Cost (Prime) Subtotal Direct Labor Cost Fringe/Overhead Cost for Labor Total Direct Labor Cost Significant Subcontracts:

Breakdown by significant subcontractor Significant Subcontractor X Labor Cost Significant Subcontractor X Overtime Cost Total Significant Subcontractor X Labor Cost Total Direct and Significant Subcontractor Labor Costs

Other Direct Cost:

Material Supplies Equipment Training Travel Contractor Cell Phones Other (including all other subcontract costs) Total ODC Overhead G&A Total Cost

Fee

Total Estimated Cost and Fee

1. DRD Title: Monthly Contractor Financial Management Report (533M) - CPFF CLIN 1004

2. DRD No.: 10 3. Data Type: 1 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use: The Contractor shall submit a Monthly Contractor Financial Management Report (NF 533M) for monitoring costs.

11. Distribution: Contracting Officer; Contracting Officer’s Representative, and Financial Management LaRC-DL-NF533@mail.nasa.gov.

Initial Submission: The Contractor shall submit the initial 533M at the completion of the first month of contract.

Submission Frequency: The Contractor shall submit the report not later than the 10th business day following the close of the Contractor's accounting period being reported each month. There is not a recurring NF533Q requirement.

Format: NASA Form 533M

Interrelationship: The contractor shall submit a Monthly Contractor Financial Management Report in accordance with NFS 1852.242-73, NASA Contractor Financial Management Reporting. The Contractor shall prepare and submit the form in accordance with the instructions set forth on the reverse side of the form and NASA Procedural Requirements (NPR) 9501.2E, NASA Contractor Financial Management Reporting.

Applicable Documents: The 533M Form and NASA Procedural Requirements (NPR) 9501.2E, NASA Contractor Financial Management Reporting.

Scope:

(1) The contractor shall complete Columns 8.a and b using estimates (forecasts) for the succeeding two months.

(2) The Contractor shall ensure that estimates (forecasts) are the best projection of the actual costs to be reported in column 7.a of the subsequent month's 533M. Since NASA uses the Contractor's estimate for the current month (column 8.a of the 533M) as accrued costs in its monthly financial statements, the accuracy of these projections is critical to the integrity of NASA’s financial data.

(3) The Contractor shall report costs on the basis of the contractor’s most current data for actual rates experienced at the time the report is prepared, rather than on the basis of Defense Contract Audit Agency (DCAA) approved provisional billing or bidding rates. In addition, the Contractor shall adjust as needed for actual cost experience to reflect rates reported in its final indirect cost rate proposal submitted after the end of each of its fiscal years in accordance with paragraph (d) of FAR 52.216-7, Allowable Cost and Payment. The Contractor shall explain in the footnotes on the 533 report any mailto:LaRC-DL-NF533@mail.nasa.gov adjustments made for actual rates as determined by the Contractor in its annual final indirect cost rate proposal.

(4) The Contractor shall include a narrative explanation for variances exceeding plus or minus10 percent (+/-

10%) between estimated costs shown in the prior month and actual costs shown in the current month at the contract level. (For example, the estimated costs shown for June in column 8.a in the May 533M and the actual June costs shown in column 7.a in the June 533M.)

(5) The Government will consider the Contractor’s accuracy of financial reporting when evaluating the

Contractor’s performance in the Contractor Reporting Assessment Reporting System (CPARS).

Contents: The minimum reporting categories indicated in the ‘Contents’ section of DRD #9 shall be included in column 6 of this report.

Remarks: The data contained in the reports shall be auditable using Generally Accepted Accounting Principles. The Government will consider the Contractor’s accuracy of financial reporting when evaluating the Contractor’s performance in the Contractor Reporting Assessment Reporting System (CPARS).

Maintenance: None required.

1. DRD Title: On and Near Site Staffing Report

2. DRD No.: 11 3. Data Type: 3 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use: Report of On-site and near- site Work Year Equivalents (WYE's) performing work on the contract, broken down by skill category, segregated by Center

11. Distribution: Contracting Officer; On and Near-Site Staffing Report, larc-dl-contractorwye@mail.nasa.gov.

Initial Submission: Within 30 calendar days from the effective date of the contract.

Submission Frequency: Subsequent updated reports are due quarterly, within the first 5 workday after the end of the quarter (e.g., on or before the 5th workday in January, April, July, and October of each year).

Format: These reports shall be e-mailed to the following: larc-dl-contractorwye@mail.nasa.gov.

The subject line for the e-mail should be "Contractor WYE".

Interrelationship: N/A

Applicable Documents: N/A

Scope: The Contractor shall submit a report which includes the number of on-site and near-site Work Year Equivalents (WYE's) performing work on the contract, broken down by skill category.

1. These reports shall be e-mailed to the following:

larc-dl-contractorwye@mail.nasa.gov The subject line for the e-mail should be "Contractor WYE".

2. "On-site" WYEs include the time worked by prime Contractor and subcontractor employees on this contract whose primary duty station is on-site at Langley Research Center, whether such employees charge direct or indirect in the Contractor's or subcontractor's accounting systems (e.g., management and administrative staff may charge their time to an "indirect" account, but the time worked by such individuals shall still be counted in the on-site WYE).

3. "Near-site" WYEs include the time worked by prime Contractor and subcontractor employees on this contract whose primary duty station is within 50 miles of LaRC, whether such employees charge direct or indirect in the Contractor's or subcontractor's accounting systems. Work performed on local college campuses shall not be considered "near site" WYE's.

4. The Contractor shall use the number of hours in its productive work year to compute the number of

WYE's to be reported. For example, if the Contractor’s standard work-year is 1,860 productive hours mailto:larc-dl-contractorwye@mail.nasa.gov mailto:larc-dl-contractorwye@mail.nasa.gov mailto:larc-dl-contractorwye@mail.nasa.gov

(excludes leave, holidays, etc.), the quarterly WYE reported would be calculated as the total labor hours for the quarter divided by the available productive hours in the quarter (in this example 1,860annual productive hours divided by 4 quarters yields 465 hours). Thus, if 10,000 hours were incurred on the contract during the quarter the WYE would be (10,000/465 = 21.5 WYE). The Contractor shall break out the On-site and Near-site WYE by skill category using the following categories: Scientist, engineer, technician, administrative professional, and clerical.

Contents: N/A

1. DRD Title: Annual IT Security Training Requirements Report

2. DRD No.: 12 3. Data Type: 1 4. OPR: OP

Administrative ☒

S&MA ☐

10. Description/Use: Requirements for all Contractor and subcontractor personnel requiring physical or logical access to NASA IT resources to complete NASA’s annual on-line IT Security Awareness training.

11. Distribution: Contract Specialist; Contracting Officer’s Representative; Center Information Technology Security Manager (CITSM)

Initial Submission: Annually

Submission Frequency: Annually – no later than July 10th of each year.

Format: Contractor’s format is acceptable if all requirements in the applicable documents is addressed.

Interrelationship: N/A

Applicable Documents: N/A

Scope: In accordance with NFS 1852.204-76,…