SECTION I

CONTRACT CLAUSES

I.1 [LISTING OF CLAUSES INCORPORATED BY REFERENCE]{.underline}

NOTICE: The following contract clauses pertinent to this section are
hereby incorporated by reference:

I. FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1)

CLAUSE

[NUMBER]{.underline} [DAT]{.underline}E [TITLE]{.underline}

52.203-3 APR 1984 GRATUITIES

52.203-5 APR 1984 COVENANT AGAINST CONTINGENT

FEES

52.203-6 JUL 1995 RESTRICTIONS ON SUBCONTRACTOR

SALES TO THE GOVERNMENT

52.203-7 JUL 1995 ANTI-KICKBACK PROCEDURES

52.203-8 JAN 1997 CANCELLATION, RESCISSION, AND RECOVERY OF FUNDS FOR
ILLEGAL OR IMPROPER ACTIVITY

52.203-10 JAN 1997 PRICE OR FEE ADJUSTMENT FOR

ILLEGAL OR IMPROPER ACTIVITY

52.203-11 APR 1991 CERTIFICATION AND DISCLOSURE REGARDING PAYMENTS TO
INFLUENCE CERTAIN FEDERAL TRANSACTIONS

52.203-12 JUN 1997 LIMITATION ON PAYMENTS TO

INFLUENCE CERTAIN FEDERAL

TRANSACTIONS

52.204-4 JUN 1996 PRINTING/COPYING DOUBLE-SIDED

ON RECYCLED PAPER

52.209-6 JUL 1995 PROTECTING THE GOVERNMENT\'S

INTEREST WHEN SUBCONTRACTING

WITH CONTRACTORS DEBARRED,

SUSPENDED, OR PROPOSED FOR

DEBARMENT

52.211-15 SEP 1990 DEFENSE PRIORITY AND ALLOCATION REQUIREMENTS

52.212-4 MAY 1997 CONTRACT TERMS AND CONDITIONS---COMMERCIAL ITEMS

52.215-2 AUG 1996 AUDIT AND RECORDS NEGOTIATION

52.215-33 JAN 1986 ORDER OF PRECEDENCE

52.219-8 JUN 1997 UTILIZATION OF SMALL, SMALL DISADVANTAGED, AND
WOMEN-OWNED SMALL BUSINESS CONCERNS

52.219-14 DEC 1996 LIMITATIONS ON SUBCONTRACTING

52.222-3 AUG 1996 CONVICT LABOR

55.222-4 JUL 1995 CONTRACT WORK HOURS AND SAFETY STANDARDS ACT OVERTIME
COMPENSATION

52.222-20 DEC 1996 WALSH-HEALY PUBLIC CONTRACTS ACT

52.222-26 APR 1984 EQUAL OPPORTUNITY

52.222-28 APR 1984 EQUAL OPPORTUNITY PREAWARD

CLEARANCE OF SUBCONTRACTS

52.222-35 APR 1984 AFFIRMATIVE ACTION FOR SPECIAL

DISABLED AND VIETNAM ERA VETERANS

52.222-36 APR 1984 AFFIRMATIVE ACTION FOR

HANDICAPPED WORKERS

52.222-37 JAN 1988 EMPLOYMENT REPORTS ON SPECIAL

DISABLED VETERANS AND VETERANS

OF THE VIETNAM ERA

52.223-2 APR 1984 CLEAN AIR AND WATER

52.223-3 JAN 1997 HAZARDOUS MATERIAL IDENTIFICATION AND MATERIAL SAFETY
DATA AND ALTERNATE I (JUL 1995)

52.223-5 MAR 1997 POLLUTION PREVENTION AND RIGHT-TO-KNOW INFORMATION

52.223-6 JAN 1997 DRUG-FREE WORKPLACE

52.223-14 OCT 1996 TOXIC CHEMICAL RELEASE REPORTING

52.225-3 JAN 1994 BUY AMERICAN ACT---SUPPLIES

52.225-10 APR 1984 DUTY FREE ENTRY

52.225-11 OCT 1996 RESTRICTIONS ON CERTAIN FOREIGN PURCHASES

52.227-1 JUL 1995 AUTHORIZATION AND CONSENT

52.227-2 AUG 1996 NOTICE AND ASSISTANCE REGARDING PATENT AND COPYRIGHT
INFRINGEMENT

52.229-3 JAN 1991 FEDERAL, STATE , AND LOCAL TAXES

52.229-4 JAN 1991 FEDERAL, STATE AND LOCAL TAXES (NONCOMPETITIVE
CONTRACT)

52.229-5 APR 1984 TAXES-CONTRACTS PERFORMED IN U.S. POSSESSIONS OR
PUERTO RICO

52.232-1 APR 1984 PAYMENTS

52.232-11 APR 1984 EXTRAS

52.232-17 JUN 1996 INTEREST

52.232-18 APR 1984 AVAILABILITY OF FUNDS

52.232-23 JAN 1986 ASSIGNMENT OF CLAIMS

52.232-25 JUN 1997 PROMPT PAYMENT

52.232-33 AUG 1996 MANDATORY INFORMATION FOR ELECTRONIC FUNDS TRANSFER
PAYMENT

52.233-1 OCT 1995 DISPUTES

52.233-3 AUG 1996 PROTEST AFTER AWARD

52.242-13 JUL 1995 BANKRUPTCY

52.243-1 AUG 1987 CHANGES---FIXED-PRICE

> (ALTERNATE II) (APR 1984)

52.243-6 APP 1984 CHANGE ORDER ACCOUNTING

52.244-1 FEB 1995 SUBCONTRACTS (FIXED-PRICE CONTRACTS)

52.245-2 DEC 1989 GOVERNMENT PROPERTY (FIXED-PRICED CONTRACTS)
(ALTERNATE I) (APR 1984)

52.246-25 FEB 1997 LIMITATION OF LIABILITY\--

SERVICES

52.248-1 MAR 1989 VALUE ENGINEERING

52.249-2 SEP 1996 TERMINATION FOR CONVENIENCE OF THE GOVERNMENT
(FIXED-PRICE)

52.249-8 APR 1984 DEFAULT (FIXED-PRICE SUPPLY AND SERVICE)

52.253-1 JAN 1991 COMPUTER GENERATED FORMS

II\. NASA FAR SUPPLEMENT (48 CFR CHAPTER 18)

CLAUSE

[NUMBER]{.underline} [DATE]{.underline} [TITLE]{.underline}

> 1852.204-76 July 2000 SECURITY REQUIREMENTS FOR UNCLASSIFIED
> INFORMATION TECHNOLOGY RESOURCES

1852.219-74 SEP 1990 USE OF RURAL AREA SMALL

BUSINESSES

1852.219-76 JUL 1991 NASA SMALL DISADVANTAGED BUSINESS SUBCONTRACTING
GOAL

1852.223-74 MAR 1996 DRUG AND ALCOHOL-FREE WORKFORCE

1852.228-75 OCT 1988 MINIMUM INSURANCE COVERAGE

1852.237-70 DEC 1988 EMERGENCY EVACUATION PROCEDURES

I.2 [APPROVAL OF CONTRACT]{.underline} (52.204-1)(DEC 1989)

This contract is subject to the written approval of the Procurement
Officer, Johnson Space Center and shall not be binding until so
approved.

(End of clause)

I.3 [RIGHTS IN DATA---GENERAL]{.underline} (52.227-14) (JUN 1987)
ALTERNATE II (JUN 1987) AS MODIFIED BY RIGHTS IN DATA---GENERAL (NASA
1852.227-14)

a.  Definitions. \"Computer software,\" as used in this clause, means
    computer programs, computer data bases, and documentation thereof.

> \"Data,\" as used in this clause, means recorded information,
> regardless of form or the media on which it may be recorded. The term
> includes technical data and computer software. The term does not
> include information incidental to contract administration, such as
> financial, administrative, cost or pricing, or management information.
>
> \"Form, fit, and function data,\" as used in this clause, means data
> relating to items, components, or processes that are sufficient to
> enable physical and functional interchangeability, as well as data
> identifying source, size, configuration, mating, and attachment
> characteristics, functional characteristics, and performance
> requirements; except that for computer software it means data
> identifying source, functional characteristics, and performance
> requirements but specifically excludes the source code, algorithm,
> process, formulae, and flow charts of the software.
>
> \"Limited rights,\" as used in this clause, means the rights of the
> Government in limited rights data as set forth in the Limited Rights
> Notice of subparagraph (g)(2) if included in this clause.
>
> \"Limited rights data,\" as used in this clause, means data (other
> than computer software) that embody trade secrets or are commercial or
> financial and confidential or privileged, to the extent that such data
> pertain to items, components, or processes developed at private
> expense, including minor modifications thereof.
>
> \"Restricted computer software,\" as used in this clause, means
> computer software developed at private expense and that is a trade
> secret; is commercial or financial and is confidential or privileged;
> or is published copyrighted computer software; including minor
> modifications of such computer software.
>
> \"Restricted rights,\" as used in this clause, means the rights of the
> Government in restricted computer software, as set forth in a
> Restricted Rights Notice of subparagraph (g)(3) if included in this
> clause, or as otherwise may be provided in a collateral agreement
> incorporated in and made part of this contract, including minor
> modifications of such computer software.
>
> \"Technical data,\" as used in this clause, means data (other than
> computer software) which are of a scientific or technical nature.
>
> \"Unlimited rights,\" as used in this clause, means the right of the
> Government to use, disclose, reproduce, prepare derivative works,
> distribute copies to the public, and perform publicly and display
> publicly, in any manner and for any purpose, and to have or permit
> others to do so.

b.  Allocation of rights. (1) Except as provided in paragraph (c) of
    this clause regarding copyright, the Government shall have unlimited
    rights in\--

> \(i\) Data first produced in the performance of this contract;
>
> \(ii\) Form, fit, and function data delivered under this contract;
>
> \(iii\) Data delivered under this contract (except for restricted
> computer software) that constitute manuals or instructional and
> training material for installation, operation, or routine maintenance
> and repair of items, components, or processes delivered or furnished
> for use under this contract; and

\(iv\) All other data delivered under this contract unless provided
otherwise for limited rights data or restricted computer software in
accordance with paragraph (g) of this clause.

> \(2\) The Contractor shall have the right to\--
>
> \(i\) Use, release to others, reproduce, distribute, or publish any
> data first produced or specifically used by the Contractor in the
> performance of this contract, unless provided otherwise in paragraph
> (d) of this clause;
>
> \(ii\) Protect from unauthorized disclosure and use those data which
> are limited rights data or restricted computer software to the extent
> provided in paragraph (g) of this clause;
>
> \(iii\) Substantiate use of, add or correct limited rights, restricted
> rights, or copyright notices and to take other appropriate action, in
> accordance with paragraphs (e) and (f) of this clause; and
>
> \(iv\) Establish claim to copyright subsisting in data first produced
> in the performance of this contract to the extent provided in
> subparagraph (c)(1) of this clause.

c.  Copyright. (1) Data first produced in the performance of this
    contract. Unless provided otherwise in paragraph (d) of this clause,
    the Contractor may establish, without prior approval of the
    Contracting Officer, claim to copyright subsisting in scientific and
    technical articles based on or containing data first produced in the
    performance of this contract and published in academic, technical or
    professional journals, symposia proceedings or similar works. The
    prior, express written permission of the Contracting Officer is
    required to establish claim to copyright subsisting in all other
    data first produced in the performance of this contract. When claim
    to copyright is made, the Contractor shall affix the applicable
    copyright notices of 17 U.S.C. 401 or 402 and acknowledgment of
    Government sponsorship (including contract number) to the data when
    such data are delivered to the Government, as well as when the data
    are published or deposited for registration as a published work in
    the U.S. Copyright Office. For data other than computer software the
    Contractor grants to the Government, and others acting on its
    behalf, a paid-up, nonexclusive, irrevocable worldwide license in
    such copyrighted data to reproduce, prepare derivative works,
    distribute copies to the public, and perform publicly and display
    publicly, by or on behalf of the Government. For computer software,
    the Contractor grants to the Government and others acting in its
    behalf, a paid-up nonexclusive, irrevocable worldwide license in
    such copyrighted computer software to reproduce, prepare derivative
    works, and perform publicly and display publicly by or on behalf of
    the Government.

> \(2\) Data not first produced in the performance of this contract. The
> Contractor shall not, without prior written permission of the
> Contracting Officer, incorporate in data delivered under this contract
> any data not first produced in the performance of this contract and
> which contains the copyright notice of 17 U.S.C. 401 or 402, unless
> the Contractor identifies such data and grants to the Government, or
> acquires on its behalf, a license of the same scope as set forth in
> subparagraph (c)(1) of this clause; provided, however, that if such
> data are computer software the Government shall acquire a copyright
> license as set forth in subparagraph (g)(3) of this clause if included
> in this contract or as otherwise may be provided in a collateral
> agreement incorporated in or made part of this contract.
>
> \(3\) Removal of copyright notices. The Government agrees not to
> remove any copyright notices placed on data pursuant to this paragraph
> (c), and to include such notices on all reproductions of the data.

d.  Release, publication and use of data. (1) The Contractor shall have
    the right to use, release to others, reproduce, distribute, or
    publish any data first produced or specifically used by the
    Contractor in the performance of this contract, except to the extent
    such data may be subject to the Federal export control or national
    security laws or regulations, or unless otherwise provided in this
    paragraph of this clause or expressly set forth in this contract.

> \(2\) The Contractor agrees that to the extent it receives or is given
> access to data necessary for the performance of this contract which
> contain restrictive markings, the Contractor shall treat the data in
> accordance with such markings unless otherwise specifically authorized
> in writing by the Contracting Officer.
>
> (3)(i) The Contractor agrees not to establish claim to copyright,
> publish or release to others any computer software first produced in
> the performance of this contract without the Contracting Officer\'s
> prior written permission.
>
> \(ii\) If the Government desires to obtain copyright in computer
> software first produced in the performance of this contract and
> permission has not been granted as set forth in paragraph (d)(3)(i) of
> this clause, the Contracting Officer may direct the contractor to
> assert, or authorize the assertion of, claim to copyright in such data
> and to assign, or obtain the assignment of, such copyright to the
> Government or its designated assignee.
>
> \(iii\) Whenever the word \"establish\" is used in this clause, with
> reference to a claim to copyright, it shall be construed to mean
> \"assert.\"

e.  Unauthorized marking of data. (1) Notwithstanding any other
    provisions of this contract concerning inspection or acceptance, if
    any data delivered under this contract are marked with the notices
    specified in subparagraph (g)(2) or (g)(3) of this clause and use of
    such is not authorized by this clause, or if such data bears any
    other restrictive or limiting markings not authorized by this
    contract, the Contracting Officer may at any time either return the
    data to the Contractor, or cancel or ignore the markings. However,
    the following procedures shall apply prior to canceling or ignoring
    the markings.

> \(i\) The Contracting Officer shall make written inquiry to the
> Contractor affording the Contractor 30 days from receipt of the
> inquiry to provide written justification to substantiate the propriety
> of the markings;
>
> \(ii\) If the Contractor fails to respond or fails to provide written
> justification to substantiate the propriety of the markings within the
> 30-day period (or a longer time not exceeding 90 days approved in
> writing by the Contracting Officer for good cause shown), the
> Government shall have the right to cancel or ignore the markings at
> any time after said period and the data will no longer be made subject
> to any disclosure prohibitions.
>
> \(iii\) If the Contractor provides written justification to
> substantiate the propriety of the markings within the period set in
> subdivision (e)(1)(i) of this clause, the Contracting Officer shall
> consider such written justification and determine whether or not the
> markings are to be canceled or ignored. If the Contracting Officer
> determines that the markings are authorized, the Contractor shall be
> so notified in writing. If the Contracting Officer determines, with
> concurrence of the head of the contracting activity, that the markings
> are not authorized, the Contracting Officer shall furnish the
> Contractor a written determination, which determination shall become
> the final agency decision regarding the appropriateness of the
> markings unless the Contractor files suit in a court of competent
> jurisdiction within 90 days of receipt of the Contracting Officer\'s
> decision. The Government shall continue to abide by the markings under
> this subdivision (e)(1)(iii) until final resolution of the matter
> either by the Contracting Officer\'s determination becoming final (in
> which instance the Government shall thereafter have the right to
> cancel or ignore the markings at any time and the data will no longer
> be made subject to any disclosure prohibitions), or by final
> disposition of the matter by court decision if suit is filed.
>
> \(2\) The time limits in the procedures set forth in subparagraph
> (e)(1) of this clause may be modified in accordance with agency
> regulations implementing the Freedom of Information Act (5 U.S.C. 552)
> if necessary to respond to a request thereunder.
>
> \(3\) This paragraph (e) does not apply if this contract is for a
> major system or for support of a major system by a civilian agency
> other than NASA and the U.S. Coast Guard agency subject to the
> provisions of Title III of the Federal Property and Administrative
> Services Act of 1949.
>
> \(4\) Except to the extent the Government\'s action occurs as the
> result of final disposition of the matter by a court of competent
> jurisdiction, the Contractor is not precluded by this paragraph (e)
> from bringing a claim under the Contract Disputes Act, including
> pursuant to the Disputes clause of this contract, as applicable, that
> may arise as the result of the Government removing or ignoring
> authorized markings on data delivered under this contract.

f.  Omitted or incorrect markings. (1) Data delivered to the Government
    without either the limited rights or restricted rights notice as
    authorized by paragraph (g) of this clause, or the copyright notice
    required by paragraph (c) of this clause, shall be deemed to have
    been furnished with unlimited rights, and the Government assumes no
    liability for the disclosure, use, or reproduction of such data.
    However, to the extent the data has not been disclosed without
    restriction outside the Government, the Contractor may request,
    within 6 months (or a longer time approved by the Contracting
    Officer for good cause shown) after delivery of such data,
    permission to have notices placed on qualifying data at the
    Contractor\'s expense, and the Contracting Officer may agree to do
    so if the Contractor\--

> \(i\) Identifies the data to which the omitted notice is to be
> applied;
>
> \(ii\) Demonstrates that the omission of the notice was inadvertent;
>
> \(iii\) Establishes that the use of the proposed notice is authorized;
> and
>
> \(iv\) Acknowledges that the Government has no liability with respect
> to the disclosure, use, or reproduction of any such data made prior to
> the addition of the notice or resulting from the omission of the
> notice.
>
> \(2\) The Contracting Officer may also (i) permit correction at the
> Contractor\'s expense of incorrect notices if the Contractor
> identifies the data on which correction of the notice is to be made,
> and demonstrates that the correct notice is authorized, or (ii)
> correct any incorrect notices.

g.  Protection of limited rights data and restricted computer
    software. (1) When data other than that listed in subdivisions
    (b)(1)(i), (ii), and (iii) of this clause are specified to be
    delivered under this contract and qualify as either limited rights
    data or restricted computer software, if the Contractor desires to
    continue protection of such data, the Contractor shall withhold such
    data and not furnish them to the Government under this contract. As
    a condition to this withholding, the Contractor shall identify the
    data being withheld and furnish form, fit, and function data in lieu
    thereof. Limited rights data that are formatted as a computer data
    base for delivery to the Government are to be treated as limited
    rights data and not restricted computer software.

> \(2\) Notwithstanding subparagraph (g)(1) of this clause, the contract
> may identify and specify the delivery of limited rights data, or the
> Contracting Officer may require by written request the delivery of
> limited rights data that has been withheld or would otherwise be
> withholdable. If delivery of such data is so required, the Contractor
> may affix the following \"Limited Rights Notice\" to the data and the
> Government will thereafter treat the data, subject to the provisions
> of paragraphs (e) and (f) of this clause, in accordance with such
> Notice:
>
> Limited Rights Notice (Jun 1987)
>
> \(a\) These data are submitted with limited rights under Government
> Contract No. NAS 9-97199. These data may be reproduced and used by the
> Government with the express limitation that they will not, without
> written permission of the Contractor, be used for purposes of
> manufacture nor disclosed outside the Government; except that the
> Government may disclose these data outside the Government for the
> following purposes, if any; provided that the Government makes such
> disclosure subject to prohibition against further use and disclosure:
>
> \[None.\]
>
> \(b\) This Notice shall be marked on any reproduction of these data,
> in whole or in part.
>
> (End of notice)
>
> \(3\) Reserved.

h.  Subcontracting. The Contractor has the responsibility to obtain from
    its subcontractors all data and rights therein necessary to fulfill
    the Contractor\'s obligations to the Government under this contract.
    If a subcontractor refuses to accept terms affording the Government
    such rights, the Contractor shall promptly bring such refusal to the
    attention of the Contracting Officer and not proceed with
    subcontract award without further authorization.

i.  Relationship to patents. Nothing contained in this clause shall
    imply a license to the Government under any patent or be construed
    as affecting the scope of any license or other right otherwise
    granted to the Government.

(End of clause)

I.4 [CLAUSES INCORPORATED BY REFERENCE]{.underline} (52.252-2) (JUN
1988)

This contract incorporates one or more clauses by reference, with the
same force and effect as if they were given in full text. Upon request,
the Contracting Officer will make their full text available.

(End of clause)

I.5 [OMBUDSMAN]{.underline} (NASA 1852.215-84) (OCT 1995)

An ombudsman has been appointed to hear concerns from Offerors,
potential Offerors, and contractors during the preaward and postaward
phases of this acquisition. The purpose of the ombudsman is not to
diminish the authority of the Contracting Officer, the Source Evaluation
Board, or the selection official, but to communicate concerns, issues,
disagreements, and recommendations of interested parties to the
appropriate Government personnel and to work to resolve them. When
requested, the ombudsman will maintain strict confidentiality as to the
source of the concern. The ombudsman does not participate in the
evaluation of proposals, the source selection process, or the
adjudication of formal contract disputes. Interested parties are invited
to call the installation ombudsman, Brian Duffy, at 281-483-6050.
Concerns, issues, disagreements, and recommendations which cannot be
resolved at the installation may be referred to the NASA ombudsman, Tom
Luedtke at 202-358-2090.

(End of clause)

**1.6 (FAR 1852.204-76)** **SECURITY REQUIREMENTS FOR UNCLASSIFIED**
**INFORMATION** **TECHNOLOGY** **RESOURCES** **(JULY 2000)**

**(a) The Contractor shall comply with the security requirements
outlined in NASA Policy Directive (NPD) 2810.1, Security of Information
Technology, and NASA Procedures and Guidelines (NPG) 2810.1, Security of
Information Technology. These policies apply to all IT systems and
networks under NASA\'s purview operated by or on behalf of the Federal
Government, regardless of location.**

**(b) (1) The Contractor shall ensure compliance by its employees with
Federal directives and guidelines that deal with IT Security including,
but not limited to, OMB Circular A-130, Management of Federal
Information Resources, OMB Circular A-130 Appendix III, Security of
Federal Automated Information Resources, the Computer Security Act of
1987 (40 U.S.C. 1441 et seq.), and all applicable Federal Information
Processing Standards (FIPS).**

**(2) All Federally owned information is considered sensitive to some
degree and must be appropriately protected by the Contractor as
specified in applicable IT Security Plans. Types of sensitive
information that may be found on NASA systems that the Contractor may
have access to include, but are not limited to \--**

**(i) Privacy Act information (5 U.S.C. 552a et seq.);**

**(ii) Export Controlled Data, (e.g. Resources protected by the
International Traffic in Arms Regulations (22 CFR Parts 120-130)).**

**(3) The Contractor shall ensure that all systems connected to a NASA
network or operated by the Contractor for NASA conform with NASA and
Center security policies and procedures.**

**(c) (1) The Contractor\'s screening of Contractor personnel will be
conducted in accordance with NPG 2810.1, Section 4.5 for personnel
requiring unescorted or unsupervised physical or electronic access to
NASA systems, programs, and data.**

**(2) The Contractor shall ensure that all such employees have at least
a National Agency Check investigation. The Contractor shall submit a
personnel security questionnaire (NASA Form 531), Name Check Request for
National Agency Check (NAC) investigation, and Standard Form 85P,
Questionnaire for Public Trust Positions (for specified sensitive
positions), and a Fingerprint Card (FD-258 with NASA overprint in Origin
Block) to the Center Chief of Security for each Contractor employee
requiring screening. The required forms may be obtained from the Center
Chief of Security. In the event that the NAC is not satisfactory, access
shall not be granted. At the option of the Government, background
screenings may not be required for employees with recent or current
Federal Government investigative clearances.**

**(3) The Contractor shall have an employee checkout process that
ensures \--**

(i) **Return of badges, keys, electronic access devices and NASA
    equipment;**

**(ii) Notification to NASA of planned employee terminations at least
three days in advance of the employee\'s departure. In the case of
termination for cause, NASA shall be notified immediately. All NASA
accounts and/or network access granted terminated employees shall be
disabled immediately upon the employee\'s separation from the
Contractor; and**

**(iii) That the terminated employee has no continuing access to systems
under the operation of the Contractor for NASA. Any access must be
disabled the day the employee separates from the Contractor.**

**(4) Granting a non-permanent resident alien (foreign national) access
to NASA IT resources requires special authorization. The Contractor
shall obtain authorization from the Center Chief of Security prior to
granting a non-permanent resident alien access to NASA IT systems and
networks.**

**(d) (1) The Contractor shall ensure that its employees with access to
NASA information**

**resources receive annual IT security awareness and training in NASA IT
Security policies,**

**procedures, computer ethics, and best practices.**

**(2) The Contractor shall employ an effective method for communicating
to all its employees and assessing that they understand any Information
Technology Security policies and guidance provided by the Center
Information Technology Security Manager (CITSM) and/or Center CIO
Representative as part of the new employee briefing process. The
Contractor shall ensure that all employees represent that they have read
and understand any new Information Technology Security policy and
guidance provided by the CITSM and Center CIO Representative over the
duration of the contract.**

**(3) The Contractor shall ensure that its employees performing duties
as system and network administrators in addition to performing routine
maintenance possess specific IT security skills. These skills include
the following:**

**(i) Utilizing software security tools.**

**(ii) Analyzing logging and audit data.**

**(iii) Responding and reporting to computer or network incidents as per
NPG 2810.1.**

**(iv) Preserving electronic evidence as per NPG 2810.1.**

**(v) Recovering to a safe state of operation.**

**(4) The Contractor shall provide training to employees to whom they
plan to assign system administrator roles. That training shall provide
the employees with a full level of proficiency to meet all NASA system
administrators\' functional requirements. The Contractor shall have
methods or processes to document that employees have mastered the
training material, or have the required knowledge and skills. This
applies to all system administrator requirements.**

**(e) The Contractor shall promptly report to the Center IT Security
Manager any suspected computer or network security incidents occurring
on any system operated by the Contractor for NASA or connected to a NASA
network. If it is validated that there is an incident, the Contractor
shall provide access to the affected system(s) and system records to
NASA and any NASA designated third party so that a detailed
investigation can be conducted.**

**(f) The Contractor shall develop procedures and implementation plans
that ensure that IT resources leaving the control of an assigned user
(such as being reassigned, repaired, replaced, or excessed) have all
NASA data and sensitive application software permanently removed by a
NASA- approved technique. NASA-owned applications acquired via a \"site
license\" or \"server license\" shall be removed prior to the resources
leaving NASA\'s use. Damaged IT storage media for which data recovery is
not possible shall be degaussed or destroyed. If the assigned task is to
be assumed by another duly authorized person, at the Government\'s
option, the IT resources may remain intact for assignment and use of the
new user.**

**(g) The Contractor shall afford NASA, including the Office of
Inspector General, access to the Contractor\'s and subcontractor\'s
facilities, installations, operations, documentation, databases and
personnel. Access shall be provided to the extent required to carry out
a program of IT inspection, investigation and audit to safeguard against
threats and hazards to the integrity, availability and confidentiality
of NASA data, and to preserve evidence of computer crime.**

**(h) (1) The Contractor shall document all vulnerability testing and
risk assessments conducted in accordance with NPG 2810.1 and any other
IT security requirements specified in the contract or as directed by the
Contracting Officer.**

**(2) The results of these tests shall be provided to the Center IT
Security Manager. Any Contractor system(s) connected to a NASA network
or operated by the Contractor for**

**NASA may be subject to vulnerability assessment or penetration testing
as part of the Center\'s IT security compliance assessment and the
Contractor shall be required to assist in the completion of these
activities.**

**(3) A decision to accept any residual risk shall be the responsibility
of NASA. The Contractor shall notify the NASA system owner and the NASA
data owner within 5 working days if new or unanticipated threats or
hazards are discovered by the Contractor, made known to the Contractor,
or if existing safeguards fail to function effectively. The Contractor
shall make appropriate risk reduction recommendations to the NASA system
owner and/or the NASA data owner and document the risk or modifications
in the IT Security Plan.**

**(i) The Contractor shall develop a procedure to accomplish the
recording and tracking of IT System Security Plans, including updates,
and IT system penetration and vulnerability tests for all NASA systems
under its control or for systems outsourced to them to be managed on
behalf of NASA. The Contractor must report the results of these actions
directly to the Center IT Security Manager.**

**(j) When directed by the Contracting Officer, the Contractor shall
submit for NASA approval a post-award security implementation plan
outlining how the Contractor intends to meet the requirements of NPG
2810.1. The plan shall subsequently be incorporated into the contract as
a compliance document after receiving Government approval. The plan
shall demonstrate thorough understanding of NPG 2810.1 and shall include
as a minimum, the security measures and program safeguards to ensure
that IT resources acquired and used by Contractor and subcontractor
personnel \--**

**(1) Are protected from unauthorized access, alteration, disclosure, or
misuse of information processed, stored, or transmitted;**

**(2) Can maintain the continuity of automated information support for
NASA missions, programs, and functions;**

**(3) Incorporate management, general, and application controls
sufficient to provide**

**cost-effective assurance of the systems\' integrity and accuracy;**

**(4) Have appropriate technical, personnel, administrative,
environmental, and access safeguards;**

**(5) Document and follow a virus protection program for all IT
resources under its control; and**

**(6) Document and follow a network intrusion prevention program for all
IT resources under its control.**

**(k) Prior to selecting any IT security solution, the Contractor shall
consult with their Center IT Security Manager to ensure interoperability
and compatibility with other systems with which there is a data or
system interface requirement.**

**(l) The Contractor shall comply with all Federal and NASA encryption
requirements for NASA flight programs (e.g., secure flight termination
systems, encryption for satellite uplinks, encryption for flight and
satellite command and control for both up and down link) and involve the
Center Communications Security (COMSEC) Manager when selecting
encryption solutions.**

**(m) The Contractor shall incorporate this clause in all subcontracts
where the requirements identified in this clause are applicable to the
performance of the subcontract.**

**(End of clause)**

\[END OF SECTION\]