Small Bodies Discipline Node

Form / Attachment / Pricing Sheet

This document outlines the "Year 1 NIST SP800-53rev5 Federally Mandated and NASA Critical Controls." It serves as a reference for specific security and privacy controls that are required or recommended.

• Section 1: Federally Mandated Critical Controls (FMCC): Details 21 specific controls, including:
  • CA-5: Plan of Action and Milestones
  • CA-6: Authorization
  • CA-7: Continuous Monitoring
  • CM-6: Configuration Settings
  • IA-2: Identification and Authentication (Organizational Users)
  • IA-2(1): Multi-factor Authentication to Privileged Accounts
  • IA-2(2): Multi-factor Authentication to Non-privileged Accounts
  • IA-2(12): Acceptance of PIV Credentials
  • IR-6: Incident Reporting
  • PL-4: Rules of Behavior
  • RA-2: Security Categorization
  • RA-5: Vulnerability Monitoring and Scanning
  • RA-8: Privacy Impact Assessments
  • SA-22: Unsupported System Components
  • SC-7(3): Access Points
  • SC-8: Transmission Confidentiality and Integrity
  • SC-8(1): Cryptographic Protection
  • SC-13: Cryptographic Protection
  • SC-28: Protection of Information at Rest
  • SC-28(1): Cryptographic Protection
  • SI-2: Flaw Remediation
• Section 2: NASA Critical Controls (NCC): Details 37 specific controls, including:
  • AC-1: Policy and Procedures
  • AT-1: Policy and Procedures
  • AT-2: Literacy Training and Awareness
  • AT-3: Role-based Training
  • AU-1: Policy and Procedures
  • AU-6: Audit Record Review, Analysis, and Reporting
  • CA-1: Policy and Procedures
  • CA-2: Control Assessments
  • CA-3: Information Exchange
  • CA-7(6): Automation Support for Monitoring
  • CM-1: Policy and Procedures
  • CM-4: Impact Analyses
  • CM-7: Least Functionality
  • CM-8: System Component Inventory
  • CP-1: Policy and Procedures
  • CP-2: Contingency Plan
  • CP-2(3): Resume Mission and Business Functions
  • CP-2(8): Identify Critical Assets
  • CP-4: Contingency Plan Testing
  • IA-1: Policy and Procedures
  • IR-1: Policy and Procedures
  • MA-1: Policy and Procedures
  • MP-1: Policy and Procedures
  • PE-1: Policy and Procedures
  • PL-1: Policy and Procedures
  • PL-2: System Security and Privacy Plans
  • PS-1: Policy and Procedures
  • PT-1: Policy and Procedures
  • RA-1: Policy and Procedures
  • RA-3: Risk Assessment
  • RA-5(5): Privileged Access
  • SA-1: Policy and Procedures
  • SA-2: Allocation of Resources
  • SA-5: System Documentation
  • SC-1: Policy and Procedures
  • SI-1: Policy and Procedures
  • SR-1: Policy and Procedures

This document is crucial for bidders to understand the specific security and privacy requirements and controls that will be applied to the system or services being procured. It directly informs the technical approach, compliance strategies, and resource allocation needed to meet the government's security and privacy standards. Bidders should review these controls to ensure their proposed solutions align with these mandates.

Form / Attachment / Pricing Sheet

This document appears to be a control catalog or matrix, likely an attachment to a larger solicitation or contract. It details various security and privacy controls, their statements, discussions, and references to related controls and standards (e.g., NIST, OMB). It is intended to outline the requirements for system security and privacy.

• Control Identifier: Unique code for each control (e.g., CA-05, IA-02).
• Control Name: Descriptive name of the control (e.g., PLAN OF ACTION AND MILESTONES, IDENTIFICATION AND AUTHENTICATION).
• Control Statement: The specific requirement or action mandated by the control.
• Discussion: Explanation and context for the control.
• Related Controls: Cross-references to other relevant controls.
• References: Citations to applicable standards, publications, and regulations (e.g., SP 800-137, OMB A-130).
• Security Baselines: Indication of which security baselines (Low, Moderate, High) the control applies to.

Bidders should review this document to understand the specific security and privacy requirements that will be imposed on the system or service they are proposing to provide. This includes understanding the expected compliance with various federal standards and regulations. This document will inform the technical approach, resource allocation, and risk management strategies necessary to meet the government's security and privacy obligations.

Statement of Work (SOW) / Performance Work Statement (PWS)

This document outlines the Level 1 and Level 2 requirements for the Planetary Data System (PDS), which supports NASA's goals in planetary science and solar system exploration by organizing and documenting digital data.

• Provide expertise to guide missions, programs, and individuals in organizing and documenting digital data.

• Serve as a single point of contact for data providers.

• Provide expert leadership in designing archival data sets.

• Assist data providers in developing archive plans, interface documents, validation procedures, and delivery schedules.

• Establish and maintain archiving standards for NASA planetary science data.

• Provide tools to assist data producers in assembling, validating, and submitting archival products.

• Collect, peer review, validate, and archive data submissions.

• Maintain a catalog of accepted archival data sets.

• Provide appropriate storage for archives.

• Maintain a distributed architecture based on scientific expertise.

• Adhere to applicable federal statutes, NASA policies, and Memoranda of Understanding.

• Follow best practices in system and software engineering for development and operations.

• Make data accessible to users for exploration and science.

• Support searches of archival holdings.

• Facilitate data transfers to users.

• Provide value-added services to aid in using archive products.

• Ensure long-term preservation and usability of data.

• PDS will be managed as a NASA project subject to NASA Procedural Requirements (NPR) 7120.8A.

• The PDS Project Office will ensure core project management functions (technical, cost, schedule, risk, procurement, configuration management) are performed consistently with NPR 7120.8 and applicable NASA standards.

• The PDS Project Office is responsible for ensuring NASA cybersecurity compliance.

• The PDS Project Office will ensure the transition of the online presence to a NASA-managed web environment.

• The PDS Project Office will maintain standards for PDS Metrics and reporting.

• The PDS Project Office will own and maintain Level 2 requirements.

• The PDS Project Office will oversee the selection/designation of a lead node for mission interaction.

Not specified in this document.

• Data must be peer-reviewed and maintained by the scientific community.
• Data submissions must comply with established archiving standards.
• Adherence to NASA Procedural Requirements (NPR) 7120.8A.
• Cybersecurity compliance is required.

Form / Attachment / Pricing Sheet

This document, NASA-SPEC-2661.Controls v2.0, is a NASA Technical Specification that defines information technology (IT) and operational technology (OT) security control baselines for NASA information systems. It outlines federally mandated critical controls, NASA critical controls, and specific requirements for High-Value Asset (HVA) systems, systems with export-controlled data, and systems with artificial intelligence (AI) components.

• Scope: Defines the purpose, applicability, tailoring, and authority for the specification.
• Applicable Documents: Lists relevant government and NIST documents that support the requirements.
• Acronyms, Abbreviations, and Definitions: Provides definitions for key terms used throughout the document.
• Control Overlay Highlights: Summarizes requirement overlays for different system types.
• NASA Control Baselines: Details specific control baselines (Federally Mandated, NASA Critical, HVA, Export-Controlled Data, AI Components) with associated controls and their applicability across IT and OT environments.
• Appendix A: Lists supporting documents for Federally Mandated Critical Controls.

This specification is crucial for any bidder proposing to provide IT or OT services, systems, or functions to NASA. It establishes the mandatory cybersecurity controls and baselines that must be adhered to. Understanding these requirements is essential for developing compliant proposals and ensuring successful contract performance. Bidders must ensure their proposed solutions meet or exceed these specified security controls.

Statement of Work (SOW) / Performance Work Statement (PWS)

This document outlines the Statement of Work for the Small Bodies Discipline Node (SBN) of the Planetary Data System (PDS). The primary objective is to ensure the long-term preservation, accessibility, and usability of planetary mission data, supporting NASA's scientific goals and preeminence in space exploration.

• Planetary Science Mission Support: Ingest, validate, and archive small bodies data from current and future planetary missions, research scientists, and ground-based observations. This includes designating Digital Object Identifiers (DOIs) for datasets and providing expertise for data submission quality.

• Data Archival, Preservation, Discovery, Distribution, and Usage: Implement NASA PDS Level 3 and 4 requirements, ensuring long-term preservation by providing authoritative copies to the NASA Space Science Data Coordinated Archive (NSSDCA). Data must be made publicly available in a secure and compliant manner.

• Cloud Migration: Migrate all Discipline Node data holdings, services, and tools to the NASA-managed cloud environment, ensuring continued accessibility and functionality.

• Standards and Documentation: Maintain PDS archiving standards, interoperability with NASA standards, and PDS4 Local Language Dictionaries (LDD).

• Working Groups: Participate in PDS working groups and support NASA Science Mission Directorate and Planetary Science Division data management activities.

• Minor Planet Center (MPC) Management: Provide technical and financial management for the MPC, processing astrometric observations, maintaining databases, and supporting follow-up observations of detected objects.

• International Asteroid Warning Network (IAWN) Support: Provide administration and data aggregation support to the Planetary Defense Coordination Office (PDCO) for IAWN.

• Quarterly reporting on metrics including total number of datasets, data volume, number of collections, and data access/download volumes.

• Specific deliverables include lists of letters of support, NSSDCA data deliveries, downtime reports, lists of tools and documentation, PDS Registry updates, and reports on data conversion and cloud migration progress.

• Compliance with cybersecurity requirements and maintenance of Interconnectivity Security Agreements (ISA's).

• Period of Performance: December 1, 2026 – November 30, 2029.

• Place of Performance: University of Maryland at College Park (UMCP) and Smithsonian Astrophysical Observatory (SAO).

• Adherence to NASA cybersecurity standards and compliance with Section 508 of the Rehabilitation Act for data accessibility.

• Any equipment purchased with NASA funding is government property and must be used solely for contract performance.

• Systems not owned by NASA must have a transition plan submitted to the PDS Project Office.

• Support for up to two in-person training events annually, with limitations on expenses.

• All developed training materials become NASA property.