Ring Moon System Discipline Node

Form / Attachment / Pricing Sheet

This document outlines the "Year 1 NIST SP800-53rev5 Federally Mandated and NASA Critical Controls." It serves as a reference for specific security and privacy controls that are required.

• Section 1: Federally Mandated Critical Controls (FMCC): Details 21 specific controls, including:
  • CA-5: Plan of Action and Milestones
  • CA-6: Authorization
  • CA-7: Continuous Monitoring
  • CM-6: Configuration Settings
  • IA-2: Identification and Authentication (Organizational Users)
  • IA-2(1): Multi-factor Authentication to Privileged Accounts
  • IA-2(2): Multi-factor Authentication to Non-privileged Accounts
  • IA-2(12): Acceptance of PIV Credentials
  • IR-6: Incident Reporting
  • PL-4: Rules of Behavior
  • RA-2: Security Categorization
  • RA-5: Vulnerability Monitoring and Scanning
  • RA-8: Privacy Impact Assessments
  • SA-22: Unsupported System Components
  • SC-7(3): Access Points
  • SC-8: Transmission Confidentiality and Integrity
  • SC-8(1): Cryptographic Protection
  • SC-13: Cryptographic Protection
  • SC-28: Protection of Information at Rest
  • SC-28(1): Cryptographic Protection
  • SI-2: Flaw Remediation
• Section 2: NASA Critical Controls (NCC): Details 37 specific controls, including:
  • AC-1: Policy and Procedures
  • AT-1: Policy and Procedures
  • AT-2: Literacy Training and Awareness
  • AT-3: Role-based Training
  • AU-1: Policy and Procedures
  • AU-6: Audit Record Review, Analysis, and Reporting
  • CA-1: Policy and Procedures
  • CA-2: Control Assessments
  • CA-3: Information Exchange
  • CA-7(6): Automation Support for Monitoring
  • CM-1: Policy and Procedures
  • CM-4: Impact Analyses
  • CM-7: Least Functionality
  • CM-8: System Component Inventory
  • CP-1: Policy and Procedures
  • CP-2: Contingency Plan
  • CP-2(3): Resume Mission and Business Functions
  • CP-2(8): Identify Critical Assets
  • CP-4: Contingency Plan Testing
  • IA-1: Policy and Procedures
  • IR-1: Policy and Procedures
  • MA-1: Policy and Procedures
  • MP-1: Policy and Procedures
  • PE-1: Policy and Procedures
  • PL-1: Policy and Procedures
  • PL-2: System Security and Privacy Plans
  • PS-1: Policy and Procedures
  • PT-1: Policy and Procedures
  • RA-1: Policy and Procedures
  • RA-3: Risk Assessment
  • RA-5(5): Privileged Access
  • SA-1: Policy and Procedures
  • SA-2: Allocation of Resources
  • SA-5: System Documentation
  • SC-1: Policy and Procedures
  • SI-1: Policy and Procedures
  • SR-1: Policy and Procedures

This document is critical for bidders to understand the specific security and privacy control requirements that will be applied to the system or service being procured. It outlines the baseline security standards that must be met, providing essential information for developing compliant proposals and solutions. Bidders should review these controls to ensure their proposed offerings align with federal and NASA mandates.

Forms / Attachments / Pricing Sheets

This document, "Appendix II PDS-FedMandatoryControlsYear 1 ComplianceReq.pdf", appears to be an attachment or form related to federal mandatory controls for Year 1 compliance. It details various security and privacy controls, their statements, discussions, and references to related controls and federal guidelines.

• Control Identifiers: Lists specific control identifiers (e.g., CA-05, IA-02, CM-06).
• Control Statements: Provides the detailed requirements for each control.
• Discussion: Offers explanations and context for each control.
• Related Controls: Cross-references other relevant controls.
• References: Cites applicable federal regulations, standards, and publications (e.g., OMB A-130, NIST SP 800-series, FIPS).
• Security Baselines: Indicates applicability to Low, Moderate, and High security baselines.

Bidders may need to review this document to understand the specific security and privacy compliance requirements that will be applied to the systems or services they are expected to provide. It outlines the mandatory controls and standards that must be adhered to, which could impact system design, implementation, and ongoing operations. Understanding these requirements is crucial for developing accurate proposals and ensuring compliance throughout the contract lifecycle.

Form / Attachment / Pricing Sheet

This document, NASA-SPEC-2661.Controls v2.0, is a NASA Technical Specification that defines information technology (IT) and operational technology (OT) security control baselines for NASA information systems. It outlines federally mandated critical controls, NASA critical controls, and specific controls for High-Value Asset (HVA) systems, systems with export-controlled data, and systems with artificial intelligence (AI) components.

• Scope: Defines the purpose, applicability, and authority for the specification.
• Applicable Documents: Lists relevant government and NASA documents that constitute requirements.
• Acronyms, Abbreviations, and Definitions: Provides definitions for terms used throughout the specification.
• Control Overlay Highlights: Summarizes requirement overlays for different system types.
• NASA Control Baselines: Details specific control baselines (Federally Mandated, NASA Critical, HVA, Export-Controlled Data, AI Components) with associated controls and their applicability across IT and OT environments.
• Appendix A: Lists supporting documents for Federally Mandated Critical Controls.

This specification is crucial for any bidder proposing to provide IT or OT solutions to NASA. It establishes the cybersecurity control requirements that must be met. Understanding these baselines and controls is essential for designing compliant systems and developing accurate proposals. Bidders must ensure their proposed solutions align with the specified control requirements, particularly those related to federally mandated controls, HVA systems, export-controlled data, and AI components, as these are often non-negotiable.

Statement of Work (SOW) / Performance Work Statement (PWS)

This document outlines the Level 1 and Level 2 requirements for the Planetary Data System (PDS), aiming to support NASA's goals in planetary science and solar system exploration by organizing and documenting digital data.

• Provide expertise to guide missions, programs, and individuals in organizing and documenting digital data.

• Act as a single point of contact for data providers wishing to submit archival data.

• Offer expert leadership in designing archival data sets.

• Assist data providers in developing archive plans, interface documents, validation procedures, and delivery schedules.

• Establish and maintain archiving standards for NASA planetary science data.

• Provide tools for data producers to assemble, validate, and submit archival products.

• Collect, peer review, and maintain organized, well-documented data in archives.

• Solicit complete and comprehensive archives from data providers.

• Receive, acknowledge, and track data submissions.

• Validate data submissions for compliance with standards.

• Conduct peer reviews to ensure completeness, accuracy, and scientific usability of content.

• Accept or reject submitted data.

• Maintain a catalog of accepted archival data sets.

• Provide appropriate storage for archives.

• Maintain a distributed architecture based on scientific expertise.

• Adhere to applicable federal statutes, NASA policies, and Memoranda of Understanding.

• Follow best practices in system and software engineering for system development and operations.

• Make data accessible to users for exploration and science.

• Support searches of archival holdings.

• Facilitate data transfers to users.

• Provide value-added services to aid in using archive products.

• Ensure long-term preservation and usability of data.

• PDS will be managed as a NASA project subject to NASA Procedural Requirements (NPR) 7120.8A.

• The PDS Project Office will ensure core project management functions (technical, cost, schedule, risk, procurement, configuration management) are performed consistent with NPR 7120.8 and applicable NASA standards.

• The PDS Project Office will ensure NASA cybersecurity compliance.

• The PDS Project Office will ensure the transition of the online presence to a NASA-managed web environment.

• The PDS Project Office will maintain standards for PDS Metrics and reporting.

• The PDS Project Office will own and maintain Level 2 requirements.

• The PDS Project Office will oversee the selection/designation of a lead node for mission interaction.

Not explicitly stated in this document, but implies ongoing management and operations.

• Adherence to NASA Procedural Requirements (NPR) 7120.8A.
• Cybersecurity compliance.
• Management of a distributed architecture.
• Establishment of archiving standards and tools.

Statement of Work (SOW) / Performance Work Statement (PWS)

This Statement of Work (SOW) outlines the requirements for the Ring Moon Systems Discipline Node (RMS) of the Planetary Data System (PDS). The primary objective is to ensure the long-term secure preservation, usability, and accessibility of NASA planetary science data, aligning with Federal laws, Executive Orders, and NASA directives.

• Planetary Science Mission Support: Ingest, validate, and peer-review data from currently observing planetary missions, research scientists, ground-based observations, and analog laboratory/field measurements. Provide expertise for data organization, documentation, and submission to ensure high-quality data archives. This includes providing letters of support for proposals and supporting new spacecraft missions.

• Essential Data Archival, Preservation, Discovery, Distribution, and Data Usage Services: Implement NASA PDS Level 3 and 4 requirements, ensuring long-term preservation by providing data to the NASA Space Science Data Coordinated Archive (NSSDCA). Ensure data is publicly available, accessible, and secured against unauthorized access and disasters, compliant with Section 508 of the Rehabilitation Act. Minimize interruptions to public data access.

• Tools and Services: Maintain and develop tools for data providers for validation and submission, documentation, user guides, and training modules. Maintain value-added services for searching and discovery, including catalog search, data visualization, and API access.

• Standards and Documentation: Maintain archiving standards for PDS data and ensure interoperability with NASA standards. Maintain PDS4 Local Language Dictionaries (LDD) and data system APIs.

• Working Groups: Support NASA Science Mission Directorate and Planetary Science Division data management activities through active participation in PDS working groups and communities of practice.

• Enterprise Modernization: Support PDS enterprise modernization by registering data holdings, converting data to PDS4, migrating data and services to a NASA-managed cloud environment, and supporting mission data pipeline evolution.

• Online Presence: Transition the Discipline Node web presence and dataset access to NASA-managed infrastructure.

• Period of Performance: December 1, 2026, to November 30, 2029.

• Place of Performance: SETI Institute (SETI), with potential travel to other PDS nodes, NASA GSFC, and NASA HQ.

• Compliance with Federal cybersecurity laws (e.g., FISMA, FITARA) and NIST SP 800-53 rev. 5.

• Data must be secured against natural disasters, unauthorized access, and modification.

• Interruptions to public data access must not exceed 14 calendar days.

• Tools, documentation, and services must be maintained both on-premises and in the NASA-managed cloud environment during migration.

• Cybersecurity compliance activities as required by SMD.

• Develop and execute a plan to transition the Discipline Node web presence and dataset access to NASA-managed infrastructure.

• Government-Furnished Equipment (GFE): NASA computers will be provided for full-time PDS Node staff. No other GPE will be provided.

• Government-Furnished Information (GFI): No specific GFI is required at the outset, but new scientific data and associated products will be received and processed.

• Limitations: Only NASA funding may be used for purchasing new equipment necessary for this effort.