Geoscience Discipline Node

Form / Attachment / Pricing Sheet

This document outlines the "Year 1 NIST SP800-53rev5 Federally Mandated and NASA Critical Controls." It serves as a reference for specific security and privacy controls that are required.

• Section 1: Federally Mandated Critical Controls (FMCC): Details 21 specific controls, including:
  • CA-5: Plan of Action and Milestones
  • CA-6: Authorization
  • CA-7: Continuous Monitoring
  • CM-6: Configuration Settings
  • IA-2: Identification and Authentication (Organizational Users)
  • IA-2(1): Multi-factor Authentication to Privileged Accounts
  • IA-2(2): Multi-factor Authentication to Non-privileged Accounts
  • IA-2(12): Acceptance of PIV Credentials
  • IR-6: Incident Reporting
  • PL-4: Rules of Behavior
  • RA-2: Security Categorization
  • RA-5: Vulnerability Monitoring and Scanning
  • RA-8: Privacy Impact Assessments
  • SA-22: Unsupported System Components
  • SC-7(3): Access Points
  • SC-8: Transmission Confidentiality and Integrity
  • SC-8(1): Cryptographic Protection
  • SC-13: Cryptographic Protection
  • SC-28: Protection of Information at Rest
  • SC-28(1): Cryptographic Protection
  • SI-2: Flaw Remediation
• Section 2: NASA Critical Controls (NCC): Details 37 specific controls, including:
  • AC-1: Policy and Procedures
  • AT-1: Policy and Procedures
  • AT-2: Literacy Training and Awareness
  • AT-3: Role-based Training
  • AU-1: Policy and Procedures
  • AU-6: Audit Record Review, Analysis, and Reporting
  • CA-1: Policy and Procedures
  • CA-2: Control Assessments
  • CA-3: Information Exchange
  • CA-7(6): Automation Support for Monitoring
  • CM-1: Policy and Procedures
  • CM-4: Impact Analyses
  • CM-7: Least Functionality
  • CM-8: System Component Inventory
  • CP-1: Policy and Procedures
  • CP-2: Contingency Plan
  • CP-2(3): Resume Mission and Business Functions
  • CP-2(8): Identify Critical Assets
  • CP-4: Contingency Plan Testing
  • IA-1: Policy and Procedures
  • IR-1: Policy and Procedures
  • MA-1: Policy and Procedures
  • MP-1: Policy and Procedures
  • PE-1: Policy and Procedures
  • PL-1: Policy and Procedures
  • PL-2: System Security and Privacy Plans
  • PS-1: Policy and Procedures
  • PT-1: Policy and Procedures
  • RA-1: Policy and Procedures
  • RA-3: Risk Assessment
  • RA-5(5): Privileged Access
  • SA-1: Policy and Procedures
  • SA-2: Allocation of Resources
  • SA-5: System Documentation
  • SC-1: Policy and Procedures
  • SI-1: Policy and Procedures
  • SR-1: Policy and Procedures

This document is crucial for bidders to understand the specific security and privacy control requirements that will be applied to the system or services being procured. It outlines the mandatory controls that must be implemented and maintained, providing a framework for compliance and risk management. Bidders should review these controls to ensure their proposed solutions meet the government's security and privacy standards.

Form / Attachment / Pricing Sheet

This document outlines the Federal Mandatory Controls for Year 1 Compliance Requirements, specifically focusing on "Appendix II PDS-FedMandatoryControlsYear 1 ComplianceReq.pdf". It details various security and privacy controls, their statements, discussions, and related references, categorized by security baselines (Low, Moderate, High).

• Control Identifiers and Names: Lists specific controls such as CA-05 (Plan of Action and Milestones), IA-02 (Identification and Authentication), CM-06 (Configuration Settings), CA-07 (Continuous Monitoring), CA-06 (Authorization), IA-02(01) (Multi-factor Authentication to Privileged Accounts), and many others.
• Control Statements: Describes the required actions or objectives for each control.
• Discussion: Provides context, explanations, and implementation guidance for each control.
• Related Controls: Lists other controls that are associated with or impacted by the current control.
• References: Cites relevant NIST publications (SP, IR), OMB circulars, FIPS, CNSSI, DOD STIGs, and other standards.
• Security Baselines: Indicates applicability across Security Baselines (Low, Moderate, High).

This document is crucial for bidders to understand the mandatory security and privacy compliance requirements that will be applied to the systems or services they might be providing. It outlines the expected security posture, control implementation, and documentation standards. Bidders should review these controls to ensure their proposed solutions and internal practices align with these federal mandates, particularly concerning data protection, access control, continuous monitoring, and incident response.

Other / Unclassified

This document, NASA-SPEC-2661.Controls v2.0, is a NASA Technical Specification that defines information technology (IT) and operational technology (OT) security control baselines. It outlines federally mandated critical controls, NASA critical controls for various system types (including High-Value Assets, systems with export-controlled data, and systems with AI components), and NASA baseline requirements.

This specification details the cybersecurity control requirements that may be applicable to NASA contracts. Bidders should review this document to understand the cybersecurity standards and controls that may be incorporated into solicitations and resulting contracts, particularly those involving IT or OT systems. It provides a framework for the security posture expected for NASA information systems and projects.

Form / Attachment / Pricing Sheet

This document outlines the Level 1 and Level 2 requirements for the Planetary Data System (PDS). It details the functions and responsibilities of the PDS in supporting NASA's planetary science and solar system exploration goals through data archiving, management, and accessibility.

• Data Support: Providing expertise to missions for organizing and documenting digital data.
• Single Point of Contact: Designating a contact for data providers.
• Archiving Standards & Tools: Establishing and maintaining standards, and providing tools for data assembly, validation, and submission.
• Data Collection & Peer Review: Collecting, validating, and peer-reviewing data submissions.
• Accessibility & Preservation: Making data accessible to users and ensuring long-term preservation and usability.
• Management: Managing the PDS as a NASA project, including project management functions, cybersecurity compliance, and transition to a NASA-managed web environment.
• Requirements Maintenance: Owning and maintaining Level 2 requirements.

This document is crucial for understanding the operational framework and requirements of the Planetary Data System. Bidders involved in projects that require data archiving or interaction with NASA's planetary science data infrastructure will need to adhere to these PDS requirements. It defines the standards, processes, and management oversight for data submission, validation, storage, and accessibility, which are critical for successful participation in related opportunities.

Statement of Work (SOW) / Performance Work Statement (PWS)

This Statement of Work (SOW) outlines the requirements for the Geosciences Discipline Node (GEO) of the Planetary Data System (PDS) to provide science data services. The primary goal is to ensure NASA's compliance with data-related Federal laws and directives by managing, preserving, and distributing planetary mission data.

• Planetary Science Mission Support: Ingest, validate, and archive geosciences data from current and future planetary missions and research scientists. This includes providing expertise for data documentation, peer-reviewing data archives, and assigning Digital Object Identifiers (DOIs).

• Data Archival, Preservation, Discovery, and Distribution: Implement NASA PDS Level 3 and 4 requirements, ensuring long-term preservation by providing data to the NASA Space Science Data Coordinated Archive (NSSDCA). Data must be made publicly available and accessible in compliance with Section 508 of the Rehabilitation Act.

• Cloud Migration: Migrate all Discipline Node data holdings, software, tools, and services to a NASA-managed cloud environment. This includes maintaining authoritative copies and value-added services for search and discovery.

• Mission Data Pipeline Evolution: Support the development of cloud-based mission data delivery and validation pipelines.

• Standards and Documentation: Maintain PDS archiving standards and interoperability with NASA standards. Maintain PDS4 Local Language Dictionaries (LDD) and data system APIs.

• Working Groups: Actively participate in PDS working groups, communities of practice, and the PDS Management Council, contributing to data standards, policies, and cloud migration planning.

• Enterprise Efficiency and Training: Identify opportunities for PDS enterprise efficiency, support user community transition to new tools and services, and provide training materials.

• Cybersecurity: Accomplish cybersecurity compliance activities as required by SMD for data, tools, and services, ensuring compliance with NASA-managed cybersecurity System Security Plans (SSPs).

• Online Presence: Transition the Discipline Node web presence and dataset access from institution-managed infrastructure to NASA-managed infrastructure.

• Quarterly reporting on deliverables, including cloud migration progress, dataset conversion to PDS4, and web presence transition.

• Specific metrics include total number of datasets, data volume, number of bundles and collections, datasets in PDS3/PDS4 format, datasets with DOI, datasets migrated to the cloud, and data access/download volumes.

• Downtime for public data access must be minimized and not exceed 14 calendar days per instance.

• Period of Performance: December 1, 2026, to November 30, 2029.

• Place of Performance: Washington University (WashU), with potential travel to other PDS sites, NASA GSFC, and NASA HQ.

• Government-Furnished Equipment (GFE): NASA computers will be provided for full-time PDS Node staff. No other GFE will be provided.

• Government-Furnished Information (GFI): No specific GFI is required at the outset, but the Node will receive scientific data and may generate associated products and software.

• Limitations: New equipment purchases must be identified as necessary, use NASA funding only, be government property, and maintained in compliance with NASA cybersecurity standards.

• Sub-contracting: Limited sub-contracting may be considered on a case-by-case basis.

• CLIN 2 (IDIQ): The contract includes an Indefinite Delivery, Indefinite Quantity (IDIQ) mechanism for additional planetary science mission support beyond routine activities, including ingest of new data, archival services, data management services, and interface geoscience activities.