NASA - National Aeronautics and Space Administration

The NASA IT Security (ITS) Division within the Office of the Chief Information Officer strategically manages Agency-wide security projects to correct known vulnerabilities, reduce barriers to cross-Center collaboration, and provide cost-effective IT security services in support of NASA's systems and e-Gov initiatives. The ITS Division ensures that information technology security across NASA meets confidentiality, integrity and availability objectives for data and information to include disaster recovery and continuity of operations for systems. The ITS Division develops and maintains an information security program that ensures consistent security policy, indentifies and implements risk-based security controls, and tracks security metrics to gauge compliance and effectiveness. The function is responsible for performing audits and reviews to assess compliance with security and privacy policies and procedures. NPD 2810.1, NASA Information Security Policy, and NPR 2810.1 Security of Information Technology, provide more details on IT security requirements at NASA.

IT Security Hotline

Users can contact the new 24x7x365 NASA Security Operations Center (SOC) by phone, 1-877-NASA-SEC (877-627-2732) or via the SOC email address (soc@nasa.gov).

NASA IT Security Requirements

The list below presents NASA Policies, Procedures, Technical Standards and other guidance related to Information Security and IT Security at NASA. These documents cover all areas of the NASA IT environment, including IT infrastructure services, IT applications, and highly specialized IT. The requirements apply to all IT resources and information systems that store, process or transmit NASA data, or that connect to NASA networks or systems, or that are located on NASA facilities.

Contractors interested in doing business with NASA and/or providing IT services or solutions to NASA should use this list as a reference for information security requirements.

NASA Policy Directives (NPD) and NASA Procedural Requirements (NPR)

Document Subject Effective Date NPR 1382.1 NASA Privacy Procedural Requirements August 10, 2007 NPD 1382.17G NASA Privacy Policy August 24, 2004 NPD 1440.6H NASA Records Management March 24, 2008 NPR 1441.1D NASA Records Retention Schedules (w/Change 4, 1/31/08) February 24, 2003 NPD 2540.1F Personal Use of Government Office Equipment Including Information Technology May 25, 2005 NPD 2800.1B Managing Information Technology March 21, 2008 NPR 2800.1 Managing Information Technology (w/Change 1, 9/17/04) September 17, 1998 NPD 2810.1D NASA Information Security Policy April 7, 2004 NPR 2810.1A Security of Information Technology May 16, 2006 NPD 2830.1 NASA Enterprise Architecture December 16, 2005 NPR 2830.1 NASA Enterprise Architecture Procedures February 9, 2006 NPR 7120.7 NASA Information Technology and Institutional Infrastructure Program and Project Management Requirements November 3, 2008

NASA Interim Directives (NID)

Document Subject Effective Date NM2810-64 NASA Interim Directive: Information Technology Security and Efficiency Requirements May 22, 2008

NASA Interim Technical Requirements (NITR)

Document Subject Effective Date NITR 2800_2 Email Services and Email Forwarding September 18, 2009 NITR 2810_14A Managing Elevated User Privileges on NASA Desktop and Laptop Computers August 17, 2009 NITR 2800_1 NASA Information Technology Waiver Requirements and Procedures August 13, 2009 NITR 2810_21 System and Services Acquisition Policy and Procedures Apr 28, 2009 NITR 2810_20 System and Communications Protection Policy and Procedures March 11, 2009 NITR 2810_23 NASA Authorizing Official (AO) Procedural Requirement Mar 01, 2009 NITR 2830_1A Networks in NASA Internet Protocol (IP) Space or NASA Physical Space February 12, 2009 NITR 2810_22 Media Protection Policy and Procedures January 7, 2009 NITR 2810_17 System Maintenance Policy and Procedures November 12, 2008 NITR 2810_19 Audit and Accountability Policy and Procedures November 12, 2008 NITR 2810_15 Contingency Planning June 9, 2008 NITR 2810_12 Continuous Monitoring May 18, 2008 NITR 1382_2 NASA Rules and Consequences to Safeguarding PII, with Change 1, dated 02/04/2008 January 28, 2008 NITR 1382_1 Personally Identifiable Information (PII) Breach Response Policy December 21, 2007

SOPs (ITS-SOP) and Handbooks (ITS-HBK)

Document Subject Effective Date ITS-HBK-0004 Managed Elevated Privileges (EP) Implementation Guidance Handbook October 20, 2009 ITS-SOP 0001.A Format and Procedures for Producing IT Security SOPs February 19, 2009 ITS-SOP 0002 NASA's Target Vulnerability Selection Procedures June 1, 2003 ITS-SOP 0004.A NASA's Information Technology Requirement (NITR) Procedures September 29, 2008 ITS-SOP 0005.B Procedure for completing a NASA IT Security Program or System Assessment June 19, 2007 ITS-SOP 0007.B System Security Plan Numbering Schema April 17, 2008 ITS-SOP 0008 Procedure for Initiating and Managing Targeted Monitoring of electronic Data (being updated) March 3, 2006 ITS-SOP 0012.B Patch Selection and Reporting Procedures (being updated) July 20, 2007 ITS-SOP 0016.C IT Security Plan Template, Requirements, Guidance and Examples April 17, 2008 TS-SOP 0017A IT Security Penetration Test Plan and Rules of Engagement June 11, 2009 ITS-SOP 0021 Network Security Vulnerability Scanning (new memo released on 2/6/09) October 5, 2005 ITS-SOP 0022.A Determining Cost Impact of Information Technology Security Incidents October 18, 2007 ITS-SOP 0030.C IT System Certification & Accreditation Process for FIPS 199 Moderate & High Systems July 7, 2008 ITS-SOP 0031.C IT System Certification & Accreditation Process for FIPS 199 Low Systems July 7, 2008 ITS-SOP 0033 External System Identification and IT Security Requirements July 19, 2007 ITS-SOP 0035 Digital Media Sanitization September 15, 2008 ITS-SOP 0040 Contingency Planning July 7, 2008 ITS-SOP 0043 Procedure for Selecting and tailoring NIST SP 800-53 Common Security Controls June 6, 2007 ITS-SOP 0044 Procedure for Responding to a Breach of PII December 21, 2007 ITS-SOP 0046A Procedure for Review and Reducing PII February 27, 2009

Standards

Document Subject Effective Date EA-STD 0001.0 Standard for Integrating Applications into the NASA Access Management, Authentication, and Authorization Infrastructure Aug 01, 2008 EA-SOP 0003.0 Procedures for Submitting a NASA Agency Forest (NAF) Deviation Request and Transition Plan Aug 01, 2008 EA-SOP 0004.0 Procedures for Submitting an Application Integration Deviation Request and Transition Plan Aug 01, 2008 NASA-STD-2804L Minimum Interoperability Software Suite June 24, 2008 NASA-STD-2805L Minimum Hardware Configurations June 24, 2008

Memoranda

From To Subject Effective Date Deputy CIO for Information Technology Security Center CIOs, Mission Directorate CIOs, Center ITSMs Implementation Plan for NIST SP 800-53, Revision 3 Security Controls 10/30/2009 Chief Information Officer (Acting) Center CIOs Delegation of Waiver Authority and Responsibility for Selected Requirements for Managing Elevated User Privileges on NASA IT Devices 9/24/2009 Assistant Administrator for Security and Program Protection, Chief Information Officer (Acting) NASA Center Directors Identity, Credential, and Access Management Business Process Leads 8/27/2009 Chief Information Officer (Acting) Center CIOs, Mission Directorate CIOs Two-Factor Token Infrastructure 8/5/2009 Chief Information Officer (Acting) Officials-in-Charge of Headquarters, Center CIOs, Mission Directorate CIOs Security and Support Policy for Smartphones 8/3/2009 Deputy Chief Information Officer for IT Security Center CIOs NASA "Secure WebEx" Now Approved for Secure Meetings and Communication of SBU Data 6/23/2009 Deputy Chief Information Officer for IT Security Center CIOs Certification and Accreditation Notices 5/21/2009 Chief Information Officer (Acting) Center CIOs Revised Deadline for Compliance with Requirements for Managing Elevated User Privileges 5/12/2009 Chief Information Officer (Acting) Center CIOs Delegation of Waiver Authority and Responsibility for Vulnerability Scanning Requirements 5/6/2009 Chief Information Officer (Acting) Officials-in-Charge of Headquarters Offices, NASA Center Directors Roles and Responsibilities for Protecting NASA Sensitive But Unclassified (SBU) Information 4/27/2009 Deputy CIO for IT Security Center CIOs, Center ITSMs FY 2009 Scanning and Vulnerability Elimination or Mitigation 2/06/2009 Chief Information Officer Officials-in-Charge of Headquarters Offices, NASA Center Directors Personally Identifiable Information (PII) Incident Reporting 1/14/2009 Senior Agency Information Security Officer Center CIOs, Mission Directorate CIOs, Center ITSMs Agency Organization-Defined Information Technology Security Controls 12/19/2008 Chief Information Officer All NASA Civil Service and Contractor Employees Policy for Use of Removable Media, Such as USB Thumb Drives 11/21/2008 Deputy CIO for IT Security Center CIOs NASA Security Operations Center Operations and NASIRC Transition 10/29/2008 Chief Information Officer Memorandum for Record Information Technology Management Board Decisions Regarding NCI Firewall Settings and SharePoint 2007 Pilots 10/8/2008 Deputy CIO for IT Security Center ITSMs, Center CAOs Certification and Accreditation Direction for FY09 9/17/2008 Senior Agency Official for Privacy Official-in-Charge of Headquarters Offices, NASA Center Directors Personally Identifiable Information (PII) Responsibilities Statement 9/8/2008 Chief Information Officer Center CIOs Deployment of the Software Refresh Portal 7/30/2008 Chief Information Officer NASA CIOs, Mission Directorate CIOs, Center ITSMs, Center Human Resources Directors, IEMP Requirement to Log and Verify Sensitive Data Extracts 6/9/2008 Chief Information Officer NASA CIOs, Mission Directorate CIOs, Center ITSMs, Center ITSMs, Center Human Resources Directors, IEMP Remote Access to Personally Identifiable Information (PII) 6/9/2008 Deputy CIO for IT Security Center ITSMs Clarification on Requirement for Contractors to Complete NASA Annual IT Security Awareness Training 6/6/2008 Deputy CIO for IT Security Center CIOs, Center ITSMs, Center Training Officers Decision to Disallow Substitutions for Basic and Managers Information Technology Security Awareness Training 2/21/2008 Deputy CIO for IT Security Center CIOs, Center ITSMs System Security Documentation in RMS 2/20/2008 Deputy CIO for IT Security Center CIOs, Center ITSMs Supplemental FY08 Guidance for Agency Security Configurations Standards and FDCC Reporting 2/20/2008 Chief Information Officer Center CIOs, Deputy CIOs Information Discovery 2/4/2008 Deputy CIO for IT Security Center CIOs, Center ITSMs Decision to Cancel Procurement Information Circular (PIC) 04-03 (System Administrator Certification Program) 1/16/2008 Chief Information Officer Official-in-Charge of Headquarters Offices, NASA Center Directors Release of NPD 2200.1A, Management of NASA Scientific and Technical Information 12/18/2007 Chief Information Officer Center CIOs, Mission Directorate CIOs Data at Rest Freeze 11/15/2007 Deputy CIO for IT Security Center CIOs, Mission Directorate CIOs Agency Security Configuration Standards: Federal Desktop Core Configurations 11/15/2007 Chief Information Officer Center Chief Information Officers Designation of FIPS-199 Impact Level for NASA's OAIT Voice Systems 7/10/2007 Chief Information Officer Center Chief Information Officers Designation of FIPS-199 Impact Level for NASA OAIT Data Center Systems 7/10/2007 Chief Information Officer Center Chief Information Officers Designation of FIPS-199 Impact Level for NASA OAIT LANs 7/10/2007 Chief Information Officer (Acting) Center CIOs, Mission Directorate CIOs, Center ITSMs FY 2007 and FY 2008 Patch Management and Security Configuration Metrics 4/4/2007 Chief Information Officer (Acting) Center CIOs, Mission Directorate CIOs Meeting OMB Memoranda M-06-015 “Safeguarding Personally Identifiable Information;” M-06-016 “Protection of Sensitive Agency Information,” and M-06-019 “Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments” 10/17/2006 Deputy Administrator Administrator/Official-in-Charge of Headquarters Offices, NASA Center Directors Meeting NASA Information Technology Security Requirements 7/26/2006 Deputy CIO for IT Security Center CIOs Designation of FIPS-199 Impact Level for NASA OAIT Desktop Systems 04/16/06 Chief Information Officer, Chief of Strategic Communications Official-in-Charge of Headquarters Offices, NASA Center Directors, Center CIOs, Mission Directorate CIOs Policy Governing NASA's Publicly Accessible Web sites 3/16/2006 Chief Information Officer, Assistant Administrator of Public Affairs Center CIOs Update of NASA Web site Linking Policy 12/15/2005 Chief Information Officer Center CIOs Update of NASA Web site Privacy Policy 11/28/2005