Task-Based Subcontract Exhibit 11 - Information and Information Technology Requirements_11-22-24.docx

Exhibit 11: Information Technology and Security Requirements

General Requirement for Securing Unclassified Information Resources

1) The Subcontractor shall protect the confidentiality, integrity, and availability of NASA and JPL Information and Information Technology (IT) resources, as well as protect NASA and JPL Information from unauthorized disclosure

2) The Subcontractor shall provide via mutually agreed-upon formats, all information required to assist NASA and JPL in their Federal Information Security Management Act (FISMA) reporting responsibilities.

3) The Subcontractor shall report any suspected IT security incidents that involve NASA or JPL data, systems, or networks by calling the JPL Unified Service Desk at 818-354-4357 and collaborate with JPL OCIO and NASA SOC in the investigation and resolution of IT security incidents.

4) The Subcontractor shall insert this clause, including this paragraph in all lower-tier subcontracts that process, manage, access or store NASA or JPL Electronic Information in support of the mission of the Agency.

5) The Subcontractor certifies that it shall comply with the requirements set forth in this clause within 90 days of subcontract execution.

Requirement for JPL Furnished Equipment

1) The subcontractor and lower tier subcontractor personnel shall solely use JPL-furnished and managed systems for the performance of this subcontract, to include any hardware that will be used to process, manage, access, or store NASA or JPL data. The deployment of JPL-furnished managed systems will be provided as part of the on-boarding process, upon subcontract award.

Requirements for Identity, Credential and Access Management

1) All subcontractor personnel and lower tier subcontractor personnel working under this JPL Subcontract shall complete the NASA JPL onboarding process and receive Identity and Credential prior to initiating work.

2) As a part of the onboarding process, Subcontractor personnel shall respond to JPL Personnel Security Office’s requests for information and submission for background investigation

3) To complete the personnel onboarding enrollment and badging process, subcontractor personnel need to travel to JPL. If the personnel is remote, outside Los Angeles, Ventura, Orange, San Bernardino, or Riverside counties, they may make arrangements to travel to the nearest NASA Center to complete the enrollment and badging process. This may be arranged when JPL Badging Office reaches out to personnel regarding scheduling their badging appointment. Travel costs are borne by the Subcontractor.

4) For badge pick up subcontractor personnel need to travel to JPL. If the personnel is remote, they can make arrangements with the JPL Badging office to travel to the nearest NASA Center to pick up their badge. Such arrangement must be made early in the badging process, when Subcontractor initially responds to JPL Badging Office for scheduling of the initial Badging appointment.

5) Completion of the onboarding and badging process is dependent on NASA approval. The process takes a minimum of 2 weeks, more if personnel require higher level LoC vetting