1804.402 General.
NASA industrial security policies and procedures are prescribed in NMI 1600.2, NASA Security Program. (See also 1842.202-72).
1804.404-70 Contract clause.
The contracting officer shall insert the clause at 1852.204-75, Security Classification Requirements, in solicitations and contracts if work to be performed will require security clearances. Insert the security clearance level applicable to the particular procurement. Include in the solicitation and contract a properly executed DD Form 254, Contract Security Classification, in accordance with NMI 1600.2. This clause may be modified to add instructions for obtaining security clearances and access to security areas that are applicable to the particular procurement and installation.
1804.470 Security requirements for unclassified automated information resources.
1804.470-1 Scope.
This section implements the procurement-related aspects of Federal policies for assuring the security of unclassified automated information resources.
1804.470-2 Policy.
NASA policies and procedures on automated information security are prescribed in NMI 2410.7, Assuring the Security and Integrity of NASA Automated Information Resources, and in NHB 2410.9, NASA Automated Information Security Handbook, Chapters 3 and 4. Security requirements for safeguarding sensitive information in unclassified Federal computer systems are required (i) in contracts for automatic data processing equipment, software, the management or operation of Data Processing Installations (DPIs) or related services and (ii) in contracts under which contractor personnel must have physical or electronic access to sensitive automated information, or automated information that supports mission-critical functions.
1804.470-3 Responsibilities.
(a) The requiring activity is responsible for providing the contracting officer with any functional and technical requirements to be included in the contract schedule. The requiring activity, together with its automated information security (AIS) manager, is also responsible for providing accurate lists of protected spaces designated as limited or controlled access areas that contractor or subcontractor personnel will enter, and of unclassified Federal computer systems containing sensitive information to which contractor personnel may require access.
(b) The requiring activity is responsible for determining if a contractor security plan for unclassified Federal computer systems will be required and evaluating and recommending approval of prospective contractors' security plans.
1804.470-4 Contract clauses.
(a) Except as provided in paragraph (b) of this section, the contracting officer shall insert the clause substantially as stated at 1852.204-76, Security Requirements for Unclassified Automated Information Resources, in solicitations and contracts involving unclassified automated information resources as described by this subpart. Paragraph (a) of the clause shall be completed with information supplied by the cognizant requiring activity.
(b) The clause prescribed in paragraph (a) of this section may be excluded from any contract when the requiring activity, in concert with its automated information security (AIS) manager, recommends that a security plan for unclassified Federal computer systems be submitted by the apparently successful offeror after notification of selection but before contract award. Under these circumstances, the contracting officer shall insert the provision at 1852.204-77, Submission of Security Plan For Unclassified Federal Computer Systems, in solicitations. The provision may be modified to identify specific information that is to be included in the security plan. The contracting officer shall incorporate the approved security plan into the contract using clause 1852.204-78, Security Plan For Unclassified Federal Computer Systems, which may be modified to omit reference to the provision when the solicitation did not include the provision.