Attachment K.5 DRD 3- Security Requirements for Unclassified IT Resources

1. DRD Title:

Security Requirements for Unclassified IT Resources

2. DRD No.: 3

3. Data Type: 1

5. Solicitation No.: 80GSFC27R0018

6. Contract No.: (Insert contract number)

7. Date Issued: 12/10/2025

8. Date Revised: N/A

4. OPR: OCIO

9. DRD Category:

Technical
☒
Administrative ☐
S&MA
☐

10. Description/Use: To ensure that IT security requirements, including training, and Cyber Supply Chain Risk Management (C-SCRM), are met during performance of this contract. 11. Distribution: All deliverables required by this DRD, except for the C-SCRM plan, shall be submitted electronically to the CO, COR, and NASA Organization’s Information System Security Officer (ISSO) (i.e., Security Officer). Approval will be provided by the ISSO. If the organization does not have an ISSO, approval will be provided by the NASA Information Owner. C-SCRM plans shall be submitted to and approved by the ICT/C-SCRM Service Element Lead at [email protected]. Initial Submission:
Information System Security and C-SCRM Plan(s): For contractor-owned systems, due at the start of phase-in. Initial submission not required for existing, approved plans for Government-owned and Contractor-managed systems. For new Federal Information Systems, due with the delivery of the system. Non-Federal System Certification: Prior to any transfer of NASA non-public information to the contractor, the contractor shall provide documentation of the certification of the non-federal system to the security officer of the NASA organization that owns the information (typically the organization responsible for the contract). If the organization does not have an ISSO, the attestation shall be provided to the NASA Information Owner. Information on Employees in Sensitive Positions/Assignments Report: At the start of phase-in IT Security Point of Contact: At the start of phase-in
IT Security Awareness Training: Training required prior to access to NASA information and systems. IT Security Role Based Training: Foundational training is provided prior to performance of assigned role. Initial evidence showing completion due at the end of phase-in. Submission Frequency:
Information System Security Plan(s) and C-SCRM Plan: As Required Non-Federal System Certification: Annually
Information on Employees in Sensitive Positions/Assignments Report: Annually IT Security Point of Contact: As Required
IT Security Awareness Training: Annual on anniversary date of initial training

IT Security Role Based Training: Annual on anniversary date of initial training. Evidence of completion due