![](media/image1.jpeg){width="7.503472222222222in"
height="10.127083333333333in"}

Page 2 of 13

NAS5-98140 Modification 11

The following lists the indicated changes:

1.  A.1.27 SECURITY REQUIREMENTS FOR UNCLASSIFIED AUTOMATED\
    INFORMATION RESOURCES (1852.204-76)(MODIFIED)(REVISED 11/2/99) is\
    deleted in its entirety and replaced to read as follows:

**1852.204-76 Security Requirements for Unclassified Information
Technology Resources.**

**\
SECURITY REQUIREMENTS FOR UNCLASSIFIED**

**INFORMATION TECHNOLOGY RESOURCES**

**(JULY 2002)**

\(a\) The Contractor shall be responsible for Information Technology
security for all systems connected to a NASA network or operated by the
Contractor for NASA, regardless of location as defined within the scope
of each delivery order. This clause is applicable to all or any part of
the contract that includes information technology resources or services
in which the Contractor must have physical or electronic access to
NASA's sensitive information contained in unclassified systems that
directly support the mission of the Agency. This includes information
technology, hardware, software, and the management, operation,
maintenance, programming, and system administration of computer systems,
networks, and telecommunications systems. Examples of tasks that require
security provisions include:

\(1\) Computer control of spacecraft, satellites, or aircraft or their
payloads;

\(2\) Acquisition, transmission or analysis of data owned by NASA with
significant replacement cost should the contractor's copy be corrupted;
and

\(3\) Access to NASA networks or computers at a level beyond that
granted the general public, e.g. bypassing a firewall.

\(b\) The Contractor shall provide, implement, and maintain an IT
Security Plan. This plan shall describe the processes and procedures
that will be followed to ensure appropriate security of IT resources
that are developed, processed, or used under this contract. The plan
shall describe those parts of the contract to which this clause applies.
The Contractor's IT Security Plan shall be compliant with Federal laws
that include, but are not limited to, the Computer Security Act of 1987
(40 U.S.C. 1441 et seq.) and the Government Information Security Reform
Act of 2000. The plan shall meet IT security requirements in accordance
with Federal and NASA policies and procedures that include, but are not
limited to:

\(1\) OMB Circular A-130, Management of Federal Information Resources,
Appendix III, Security of Federal Automated Information Resources;

\(2\) NASA Procedures and Guidelines (NPG) 2810.1, Security of
Information Technology; and

> Page 3 of 13
>
> NAS5-98140
>
> Modification 11

\(3\) Chapter 3 of NPG 1620.1, NASA Security Procedures and Guidelines.

\(c\) Within 30 days after contract award, the contractor shall submit
for NASA approval an IT Security Plan. This plan must be consistent with
and further detail the approach contained in the offeror\'s proposal or
sealed bid that resulted in the award of this contract and in compliance
with the requirements stated in this clause. The plan, as approved by
the Contracting Officer, shall be incorporated into the contract as a
compliance document.

(d)(1) Contractor personnel requiring privileged access or limited
privileged access to systems operated by the Contractor for NASA or
interconnected to a NASA network shall be screened at an appropriate
level in accordance with NPG 2810.1, Section 4.5; NPG 1620.1, Chapter 3;
and paragraph (d)(2) of this clause. Those Contractor personnel with
non-privileged access do not require personnel screening. NASA shall
provide screening using standard personnel screening National Agency
Check (NAC) forms listed in paragraph (d)(3) of this clause, unless
contractor screening in accordance with paragraph (d)(4) is approved.
The Contractor shall submit the required forms to the NASA Center Chief
of Security (CCS) within fourteen (14) days after contract award or
assignment of an individual to a position requiring screening. The forms
may be obtained from the CCS. At the option of the government, interim
access may be granted pending completion of the NAC.

\(2\) Guidance for selecting the appropriate level of screening is based
on the risk of adverse impact to NASA missions. NASA defines three
levels of risk for which screening is required (IT-1 has the highest
level of risk):

\(i\) **IT-1** \-- Individuals having privileged access or limited
privileged access to systems whose misuse can cause very serious adverse
impact to NASA missions. These systems include, for example, those that
can transmit commands directly modifying the behavior of spacecraft,
satellites or aircraft.

\(ii\) **IT-2 \--** Individuals having privileged access or limited
privileged access to systems whose misuse can cause serious adverse
impact to NASA missions. These systems include, for example, those that
can transmit commands directly modifying the behavior of payloads on
spacecraft, satellites or aircraft; and those that contain the primary
copy of "level 1" data whose cost to replace exceeds one million
dollars.

\(iii\) **IT-3 \--** Individuals having privileged access or limited
privileged access to systems whose misuse can cause significant adverse
impact to NASA missions. These systems include, for example, those that
interconnect with a NASA network in a way that exceeds access by the
general public, such as bypassing firewalls; and systems operated by the
contractor for NASA whose function or data has substantial cost to
replace, even if these systems are not interconnected with a NASA
network.

\(3\) Screening for individuals shall employ forms appropriate for the
level of risk as follows:

> Page 4 of 13
>
> NAS5-98140
>
> Modification 11

\(i\) IT-1: Fingerprint Card (FC) 258 and Standard Form (SF) 85P,
Questionnaire for Public Trust Positions;

> \(ii\) IT-2: FC 258 and SF 85, Questionnaire for Non-Sensitive
> Positions; and

::: Definition-Term
\(iii\) IT-3: NASA Form 531, Name Check, and FC 258.
:::

::: Definition-Term
\(4\) The Contracting Officer may allow the Contractor to conduct its
own screening of individuals requiring privileged access or limited
privileged access provided the Contractor can demonstrate that the
procedures used by the Contractor are equivalent to NASA\'s personnel
screening procedures. As used here, equivalent includes a check for
criminal history, as would be conducted by NASA, and completion of a
questionnaire covering the same information as would be required by
NASA.
:::

\(5\) Screening of contractor personnel may be waived by the Contracting
Officer for those individuals who have proof of \--

::: Definition-Term
\(i\) Current or recent national security clearances (within last three
years);
:::

::: Definition-Term
\(ii\) Screening conducted by NASA within last three years; or
:::

::: Definition-Term
\(iii\) Screening conducted by the Contractor, within last three years,
that is equivalent to the NASA personnel screening procedures as
approved by the Contracting Officer under paragraph (d)(4) of this
clause.
:::

\(e\) The Contractor shall ensure that its employees, in performance of
the contract, receive annual IT security training in NASA IT Security
policies, procedures, computer ethics, and best practices in accordance
with NPG 2810.1, Section 4.3 requirements. The contractor may use
web-based training available from NASA to meet this requirement.

\(f\) The Contractor shall afford NASA, including the Office of
Inspector General, access to the Contractor's and subcontractors'
facilities, installations, operations, documentation, databases and
personnel used in performance of the contract. Access shall be provided
to the extent required to carry out a program of IT inspection,
investigation and audit to safeguard against threats and hazards to the
integrity, availability and confidentiality of NASA data or to the
function of computer systems operated on behalf of NASA, and to preserve
evidence of computer crime.

\(g\) The Contractor shall incorporate the substance of this clause in
all subcontracts that meet the conditions in paragraph (a) of this
clause.

**(End of clause)**

2.  Add the following to ADDENDUM 1, SCHEDULE AND ADDITIONAL PROVISIONS:

::: Definition-Term
A.1.39 1852.223-70 Safety and Health (APRIL 2002)
:::

::: Definition-Term
\(a\) Safety is the freedom from those conditions that can cause death,
injury, occupational illness, damage to or loss of equipment or
property, or damage to the
:::

::: Definition-Term
environment. NASA's safety priority is to protect: (1) the public, (2)
astronauts and pilots, (3) the NASA workforce (including contractor
employees working on
:::

::: Definition-Term
NASA contracts), and (4) high-value equipment and property.
:::

> Page 5 of 13
>
> NAS5-98140
>
> Modification 11

::: Definition-Term
\(b\) The Contractor shall take all reasonable safety and occupational
health measures in performing this contract. The Contractor shall comply
with all Federal, State, and local laws applicable to safety and
occupational health and with the safety and occupational health
standards, specifications, reporting requirements, and any other
relevant requirements of this contract.
:::

::: Definition-Term
\(c\) The Contractor shall take, or cause to be taken, any other safety,
and occupational health measures the Contracting Officer may reasonably
direct. To the extent that the Contractor may be entitled to an
equitable adjustment for those measures under the terms and conditions
of this contract, the equitable adjustment shall be determined pursuant
to the procedures of the changes clause of this contract; provided, that
no adjustment shall be made under this Safety and Health clause for any
change for which an equitable adjustment is expressly provided under any
other clause of the contract.
:::

::: Definition-Term
\(d\) The Contractor shall immediately notify and promptly report to the
Contracting Officer or a designee any accident, incident, or exposure
resulting in fatality,
:::

::: Definition-Term
lost-time occupational injury, occupational disease, contamination of
property beyond any stated acceptable limits set forth in the contract
Schedule; or property loss
:::

::: Definition-Term
of \$25,000 or more, or Close Call (a situation or occurrence with no
injury, no damage or only minor damage (less than \$1,000) but possesses
the potential to cause any type mishap, or any injury, damage, or
negative mission impact) that may be of immediate interest to NASA,
arising out of work performed under this contract. The Contractor is not
required to include in any report an expression of opinion as to the
fault or negligence of any employee. In addition, service contractors
(excluding construction contracts) shall provide quarterly reports
specifying lost-time frequency rate, number of lost-time injuries,
exposure, and accident/incident dollar losses as specified in the
contract Schedule.
:::

::: Definition-Term
\(e\) The Contractor shall investigate all work-related incidents,
accidents, and Close Calls, to the extent necessary to determine their
causes and furnish the Contracting Officer a report, in such form as the
Contracting Officer may require, of the investigative findings and
proposed or completed corrective actions.
:::

::: Definition-Term
(f)(1) The Contracting Officer may notify the Contractor in writing of
any noncompliance with this clause and specify corrective actions to be
taken. When the
:::

::: Definition-Term
Contracting Officer becomes aware of noncompliance that may pose a
serious or imminent danger to safety and health of the public,
astronauts and pilots, the
:::

::: Definition-Term
NASA workforce (including contractor employees working on NASA
contracts), or high value mission critical equipment or property, the
Contracting Officer shall
:::

::: Definition-Term
notify the Contractor orally, with written confirmation. The Contractor
shall promptly take and report any necessary corrective action.
:::

::: Definition-Term
\(2\) If the Contractor fails or refuses to institute prompt corrective
action in accordance with subparagraph (f)(1) of this clause, the
Contracting Officer may
:::

::: Definition-Term
invoke the stop-work order clause in this contract or any other remedy
available to the Government in the event of such failure or refusal.
:::

> Page 6 of 13
>
> NAS5-98140

::: Definition-Term
> Modification 11
:::

::: Definition-Term
\(g\) The Contractor (or subcontractor or supplier) shall insert the
substance of this clause, including this paragraph (g) and any
applicable Schedule provisions and clauses, with appropriate changes of
designations of the parties, in all solicitations and subcontracts of
every tier, when one or more of the following conditions exist:
:::

::: Definition-Term
\(1\) The work will be conducted completely or partly on premises owned
or controlled by the Government.
:::

::: Definition-Term
\(2\) The work includes construction, alteration, or repair of
facilities in excess of the simplified acquisition threshold.
:::

::: Definition-Term
\(3\) The work, regardless of place of performance, involves hazards
that could endanger the public, astronauts and pilots, the NASA
workforce (including
:::

::: Definition-Term
Contractor employees working on NASA contracts), or high value equipment
or property, and the hazards are not adequately addressed by
Occupational Safety
:::

::: Definition-Term
and Health Administration (OSHA) or Department of Transportation (DOT)
regulations (if applicable).
:::

::: Definition-Term
\(4\) When the Contractor (or subcontractor or supplier) determines that
the assessed risk and consequences of a failure to properly manage and
control the
:::

::: Definition-Term
hazard(s) warrants use of the clause.
:::

::: Definition-Term
\(h\) The Contractor (or subcontractor or supplier) may exclude the
provisions of paragraph (g) from its solicitation(s) and subcontract(s)
of every tier when it determines that the clause is not necessary
because the application of the OSHA and DOT (if applicable) regulations
constitute adequate safety and occupational health protection. When a
determination is made to exclude the provisions of paragraph (g) from a
solicitation and subcontract, the Contractor must notify and provide the
basis for the determination to the Contracting Officer. In subcontracts
of every tier above the micro-purchase threshold for which paragraph (g)
does not apply, the Contractor (or subcontractor or supplier) shall
insert the substance of paragraphs (a), (b), (c), and (f) of this
clause).
:::

::: Definition-Term
\(i\) Authorized Government representatives of the Contracting Officer
shall have access to and the right to examine the sites or areas where
work under this contract is being performed in order to determine the
adequacy of the Contractor\'s safety and occupational health measures
under this clause.
:::

::: Definition-Term
\(j\) The contractor shall continually update the safety and health plan
when necessary. In particular, the Contractor shall furnish a list of
all hazardous operations to
:::

::: Definition-Term
be performed, and a list of other major or key operations required or
planned in the performance of the contract, even though not deemed
hazardous by the
:::

::: Definition-Term
Contractor. NASA and the Contractor shall jointly decide which
operations are to be considered hazardous, with NASA as the final
authority. Before hazardous
:::

::: Definition-Term
operations commence, the Contractor shall submit for NASA concurrence
\--
:::

::: Definition-Term
\(1\) Written hazardous operating procedures for all hazardous
operations; and/or
:::

::: Definition-Term
\(2\) Qualification standards for personnel involved in hazardous
operations.
:::

::: Definition-Term
(End of clause)
:::

> Page 7 of 13
>
> NAS5-98140

::: Definition-Term
> Modification 11
:::

3.  Add the following to ADDENDUM 1, SCHEDULE AND ADDITIONAL PROVISIONS:

::: Definition-Term
> A.1.40 1852.223-75 Major Breach of Safety or Security (FEBRUARY 2002)
:::

::: Definition-Term
> \(a\) Safety is the freedom from those conditions that can cause
> death, injury, occupational illness, damage to or loss of equipment or
> property, or damage to the
:::

::: Definition-Term
> environment. Safety is essential to NASA and is a material part of
> this contract. NASA's safety priority is to protect: (1) the public;
> (2) astronauts and pilots; (3) the NASA workforce (including
> contractor employees working on NASA contracts); and (4) high-value
> equipment and property. A major breach of safety may constitute a
> breach of contract that entitles the Government to exercise any of its
> rights and remedies applicable to material parts of this contract,
> including
:::

::: Definition-Term
> termination for default. A major breach of safety must be related
> directly to the work on the contract. A major breach of safety is an
> act or omission of the
:::

::: Definition-Term
> Contractor that consists of an accident, incident, or exposure
> resulting in a fatality or mission failure; or in damage to equipment
> or property equal to or greater than
:::

::: Definition-Term
> \$1 million; or in any \"willful\" or \"repeat\" violation cited by
> the Occupational Safety and Health Administration (OSHA) or by a state
> agency operating under an OSHA approved plan.
:::

::: Definition-Term
> \(b\) Security is the condition of safeguarding against espionage,
> sabotage, crime (including computer crime), or attack. A major breach
> of security may constitute a breach of contract that entitles the
> Government to exercise any of its rights and remedies applicable to
> material parts of this contract, including termination for
:::

::: Definition-Term
> default. A major breach of security may occur on or off Government
> installations, but must be related directly to the work on the
> contract. A major breach of security is an act or omission by the
> Contractor that results in compromise of classified information,
> illegal technology transfer, workplace violence resulting in criminal
> conviction, sabotage, compromise or denial of information technology
> services, equipment or property damage from vandalism greater than
> \$250,000, or theft greater than \$250,000.
:::

::: Definition-Term
> \(c\) In the event of a major breach of safety or security, the
> Contractor shall report the breach to the Contracting Officer. If
> directed by the Contracting Officer, the Contractor shall conduct its
> own investigation and report the results to the Government. The
> Contractor shall cooperate with the Government investigation, if
> conducted.
:::

::: Definition-Term
> (End of clause)
:::

4.  Add the following to ADDENDUM 1, SCHEDULE AND ADDITIONAL PROVISIONS:

::: Definition-Term
> A.1.41 AWARD FEE
:::

::: Definition-Term
> The use of an award fee incentive for performance or delivery is
> authorized in addition to a Performance Retainage Pool and a Metric
> Performance
:::

> Page 8 of 13
>
> NAS5-98140

::: Definition-Term
> Modification 11
:::

::: Definition-Term
> Retainage Pool under individual delivery orders. Award fee incentives
> shall be based solely on factors other than cost as specified in FAR
> 16.404. The contract type remains IDIQ firm-fixed-price. If an
> ordering entity decides to incorporate an award fee incentive, the
> specific terms of the award fee will be identified in individual
> delivery orders. The provision for an award fee is applicable only to
> delivery orders awarded subsequent to the effective date of this
> modification.
:::

5.  Add the following to ADDENDUM 1, SCHEDULE AND ADDITIONAL PROVISIONS:

::: Definition-Term
> A.1.42 INCENTIVE FEE
:::

::: Definition-Term
> The use of an incentive fee for performance or delivery is authorized
> in addition to a Performance Retainage Pool and a Metric Performance
> Retainage Pool under individual delivery orders. Incentive fees shall
> be based solely on factors other than cost as specified in FAR
> 16.402-2 and 16.402-3. The contract type remains IDIQ
> firm-fixed-price. If an ordering entity decides to incorporate an
> incentive fee, the specific terms of the incentive fee will be
> identified in individual delivery orders. The provision for an
> incentive fee is applicable only to delivery orders awarded subsequent
> to the effective date of this modification.
:::

6.  ::: Definition-Term
    Add the following to ATTACHMENT B DATA REQUIREMENT DOCUMENTS
    (REVISED 11/123/01), B.1 BACKGROUND, Table B.1 DRD Listing:
    :::

::: Definition-Term
> ODIN-1A Asset Transition Value (ATV) Report Section C.5.6.4. DRD#
> ODIN-1A is applicable only to new delivery orders awarded after the
> effective date of this modification and is not applicable to interim
> delivery order extensions being negotiated prior to the effective date
> of this modification.
:::

::: Definition-Term
7\. ATTACHMENT B DATA REQUIREMENT DOCUMENTS (REVISED 11/123/01) -- Add
DRD ODIN 1A (shown as Attachment 1 to this document)
:::

8\. The contract in its entirety is revised globally throughout the
contract including all attachments and all modifications as follows:

> The name Lewis Research Center (LeRC) is replaced by the name Glenn
>
> Research Center at Lewis Field (GRC).

### 9. C.4.1.2 NASA CIO OPERATING MODEL is revised adding text as indicated by bolded text as follows:

> NASA is responsible for establishing and maintaining the Agency and
> Center IT architectures and standards that define the minimum
> interoperability and functionality requirements. This is accomplished
> through the CIO Operating Model, described in NASA Procedural Guide
> (NPG) 2800. Agency-level IT
>
> Page 9 of 13
>
> NAS5-98140
>
> Modification 11
>
> architectures and standards are established and maintained through an
> intra-
>
> Agency consensus based process as described in the CIO Operating
> Model. The ODIN Contractors shall implement the NASA IT architectures
> and standards which are published in NASA's IT Technical Standards --
> Directives. Information regarding the IT Technical Standards --
> Directives can be found at
> <http://www.hq.nasa.gov/office/codea/codeao/xnotice.html>**.** In
> addition to Agency level architectures and standards, the individual
> Centers have their own unique processes and documents through which
> Center level IT architectures and standards are issued. NASA is
> shifting the responsibility to select specific IT systems and products
> to meet NASA IT requirements and implement all NASA established
> standards to the ODIN Contractors. **However, to maintain common
> functionality across the Agency, including non-ODIN seats, NASA may
> specify product offerings by name if standards level specifications
> are insufficient to maintain an enterprise architecture.** **The
> Government will assume responsibility for liabilities and revisions to
> price associated with this and price will be negotiated at that
> time.** All ODIN Contractors are jointly and mutually responsible for
> all system-level and product-level integration testing to ensure
> interoperability and functionality, as well as compliance with Agency
> and Center IT standards and architectures. **However, some products or
> sources of supply may be specified by NASA to maintain
> interoperability across the Agency systems or to comply with Federal
> procurement initiatives.**

### C.5.6.4 ASSET REPORTING REQUIREMENTS is revised adding text as indicated by bolded text as follows:

### The Contractor shall provide periodic reports as required by DRD 1 including the content specified by DRD# ODIN-1A. (This includes reporting requirements stated in C.5.6.1 and C.5.6.3). The Contractor shall allow, to the Center ODIN customer base on an ongoing basis, electronic access and SQL query capability to the asset databases.

> 11\. The following text is added:\
> C.5.7.5 USER ASSISTANCE FOR CATALOG SERVICES\
> a. The Contractor shall provide the consultation services, identified
> in the Master\
> Contract Section C.5.3 (k), for catalog services.\
> \
> b. In addition to the requirements set forth in Master Contract
> Section C.5.7.1, the Contractor shall provide all necessary software
> and hardware components required to make the ordered catalog
> products/services functional. In addition to the conditions set forth
> in C.5.7.1, the Contractor shall provide all necessary software and
> hardware components required to make the ordered catalog products
> functional such as cables, cards, software, add-ons, and other
> required
>
> Page 10 of 13
>
> NAS5-98140
>
> Modification 11
>
> components. The Contractor shall identify as part of the catalog
> service description all components required to make the catalog
> products/services
>
> functional. The Contractor will not be responsible for providing
> additional components to accommodate changes in user requirements
> after the catalog order is placed.

12. The following is added:

C.5.7.6 RE-UTILIZATION OF CATALOG PRODUCT-UNIQUE SERVICES\
If a seat with any catalog (CSCC) product-unique items is deleted or
cancelled, then the catalog service associated with that seat shall
remain available for use by the Government for the remainder of the
catalog period of performance. The service shall be directly transferred
to another seat or held in account by the Contractor until transferred
to a new or existing seat. The category of maintenance (Category 1 or 3)
for the service remains the same as originally ordered. The contractor
shall provide access to a listing of services that are held

in account by the contractor and which have not been transferred to a
new or existing seat. When an item can be made functional with a system
designated by the Government, the contractor shall implement the
Governments request for transfer. When an item can\'t be made
functional, the Government shall at its discretion replace the item by
augmenting with a catalog purchase and the existing transfer item shall
be returned to be held in account by the Contractor until transferred
again to a new or existing seat.\
\
a. If the service was initially ordered as Category 1 and requires a
physical re-\
installation, the move and re-installation shall be counted under
Master\
Contract Section E.3.1.8. However, in subsequent moves and
re-installations\
of the same product-unique service item, the move and re-installation
service\
will be ordered from the catalog.\
\
b. If the service was initially ordered as Category 3, the Government is
required\
to move and re-install the item. If the Contractor is requested to move
or re-\
install, the move and re-installation services will be ordered from the
catalog.\
\
c. In the event a user transfers the catalog item to another ODIN seat,
the\
Government will notify the Contractor of the change.\
\
d. For any items that have defined time periods (e.g., annual
maintenance\
contracts on UNIX software), the time period will not be extended
because the\
item is held in account. The time period that the item is held in
account will\
be counted toward the ordered time period.

> Page 11 of 13
>
> NAS5-98140

Modification 11

### 13. C.5.9.9 Excess celluLar phone usage is revised to read as indicated as follows:

> **Cellular phone use** **in excess of negotiated plan minutes will be
> billed at the rate established in the delivery order or CSCC, as
> appropriate.**

### 14. C.7.1 PERIODIC/ROUTINE TECHNOLOGY REFRESHMENT is revised adding text as indicated by bolded text as follows:

> C.7.1.1 ODIN Desktop seats have fixed technology refreshment periods
> included as a service level component. The Contractor shall
> periodically assess the\
> offerings for each seat and update the seat configuration based on the
> best value to the Government for each seat functionality and price.
> The Contractor shall, at a minimum, refresh 1/n of the seats with an n
> year refreshment cycle each year where n is the refresh period.
> Desktop performance will be measured using the methodology defined in
> Attachment N, ODIN Performance Specifications, and shall meet or
> exceed the performance measures identified in Attachment R, Technology
> Refreshment Baseline**. As an alternative, Delivery Orders may specify
> n in monthly terms (e.g., 3 year refresh with no refresh in December =
> 1/33 to be refreshed each month, other than December).\
> **

15\. C.8.5 SECURITY INCIDENT REPORTING is revised adding text as
indicated by bolded text as follows:

> The Contractor shall promptly report to the Center Information
> Technology Security Manager **and Computer Security Official** any
> suspected computer or network security incidents occurring on any
> systems. If it is validated that there is an incident, the Contractor
> shall provide all necessary assistance and access to the affected
> systems so that a detailed investigation can be conducted and lessons
> learned documented. Security logs and audit information shall be
> handled according to evidence preservation procedures.

16. C.8.1 Computer Security Requirements is revised adding text as
    indicated by bolded text as follows:

The requirements stated in NASA Policy Directive (NPD) **2810.1**,
**"Security of Information Technology"** and **NASA Procedures and
Guidelines** (NPG) 2810.1, **"Security of Information Technology"**
apply to all IT systems and networks under NASA\'s purview operated by
or on behalf of the Federal Government, whether located in Federal,
contractor or subcontractor installations. This includes all
workstations, servers and portable computers (e.g. laptops and
notebooks) used by NASA employees and NASA contractors to remotely
access NASA computing and networking resources regardless of location.
Remote

> Page 12 of 13
>
> NAS5-98140
>
> Modification 11

access is defined as logging into a NASA computer system through a
network or a modem to execute a command on the NASA computer system from
a remote

location, or to manipulate data stored on a NASA computer system from a
remote location. Compliance with these requirements will be monitored by
periodic computer security audits performed by or on behalf of NASA. All
information processed, stored, or transmitted by contractor equipment
belongs to the Government, even though the Contractor may own the
equipment. By having the responsibility to maintain the equipment, the
Contractor does not acquire access rights to the information or rights
to redistribute the information. The Contractor understands that civil,
criminal, or administrative penalties may apply for failure to protect
information appropriately.

17\. Add the following:

> C.8.8 SYSTEM ADMINISTRATOR SECURITY CERTIFICATION PROGRAM In addition
> to any other requirements of this contract, all individuals who
> perform tasks as a system administrator or have authority to perform
> tasks normally performed by system administrator shall be required to
> demonstrate knowledge appropriate to those tasks. This demonstration,
> referred to as the NASA System Administrator Security Certification,
> is a NASA funded two-tier assessment to verify that system
> administrators are able to --
>
> 1\. Demonstrate knowledge in system administration for the operating
> systems for which they have responsibility.
>
> 2\. Demonstrate knowledge in the understanding and application of
> Network and Internet Security.
>
> Certification is granted upon achieving a score above the
> certification level on both an Operating System test and the Network
> and Internet Security Test. The Certification earned under this
> process will be valid for three years. The criteria for this skills
> assessment has been established by the NASA Chief Information Officer.
> The objectives and procedures for this certification can be obtained
> by contacting the IT Security Awareness and Training Center at (216)
> 433-2063.
>
> A system administrator is one who provides IT services, network
> services, files storage, web services, to someone else other than
> themselves and takes or assumes the responsibility for the security
> and administrative controls of that service or machine. A lead system
> administrator has responsibility for information technology security
> (ITS) for multiple computers or network devises represented within a
> system; ensuring all devices assigned to them are kept in a secure
> configuration (patched/mitigated); and ensuring that all other system
> administrators under their lead understand and perform ITS duties. An
> individual that has full access or arbitrative rights on a system or
> machine that is only servicing themselves does not constitute a
> \"system administrator\" since they are only providing or accepting
> responsibility for their system. An individual that is
>
> Page 13 of 13
>
> NAS5-98140
>
> Modification 11
>
> only servicing themselves is not required to obtain a System
> Administrator Certification.

All other terms and conditions of this delivery order remain unchanged.

> **ATTACHMENT 1**
>
> **NAS5-98140**
>
> **MODIFICATION 11**

+--------------------------+--------------------+---------------------+
| **NATIONAL AERONAUTICS   | **[D               | # CON               |
| AND SPACE                | ATA]{.underline}** | TRACT #: NAS5-98140 |
| ADMINISTRATION**         |                    |                     |
|                          | **[REQUIREM        | **DRD #: ODIN- 1A   |
| **Goddard Space Flight   | ENT]{.underline}** | Page 1 of 2**       |
| Center**                 |                    |                     |
|                          | **[DESCRIPT        |                     |
| **Greenbelt, MD 20771**  | ION]{.underline}** |                     |
+--------------------------+--------------------+---------------------+
| **3. TITLE:** ASSET      |                    |                     |
| TRANSITION VALUE REPORT  |                    |                     |
+--------------------------+--------------------+---------------------+
| ###                      |                    |                     |
| # SUBMITTAL REQUIREMENTS |                    |                     |
+--------------------------+--------------------+---------------------+
| **4. TYPE:**             | **5. FREQUENCY OF  |                     |
|                          | SUBMISSION:**      |                     |
|                          | Quarterly based on |                     |
|                          | calendar year      |                     |
+--------------------------+--------------------+---------------------+
| **6. DISTRIBUTION:** 1   | **7. INITIAL       |                     |
| copy each to DOCO and    | SUBMISSION:**      |                     |
| DOCOTR                   | First issuance     |                     |
|                          | within 90 days     |                     |
|                          | after issuance of  |                     |
|                          | delivery order     |                     |
+--------------------------+--------------------+---------------------+
| **8. REMARKS:**          |                    |                     |
+--------------------------+--------------------+---------------------+
| **DATA REQUIREMENT       |                    |                     |
| DESCRIPTION**            |                    |                     |
+--------------------------+--------------------+---------------------+
| **9. USE:** To determine |                    | **10. REFERENCE:**  |
| the value of contractor  |                    |                     |
| assets that may          |                    | **A.1.14**          |
| transition to another    |                    |                     |
| Vendor or the            |                    |                     |
| Government.              |                    |                     |
+--------------------------+--------------------+---------------------+
|                          |                    | **11.               |
|                          |                    | I                   |
|                          |                    | NTERRELATIONSHIP:** |
+--------------------------+--------------------+---------------------+
| **12. PREPARATION        |                    |                     |
| INFORMATION**:\          |                    |                     |
| \                        |                    |                     |
| The ATV applies to       |                    |                     |
| Contractor assets that   |                    |                     |
| are used in the          |                    |                     |
| performance of providing |                    |                     |
| ODIN seat services and   |                    |                     |
| may include hardware,    |                    |                     |
| software, contracted or  |                    |                     |
| prepaid maintenance or   |                    |                     |
| services contracts. The  |                    |                     |
| ATV includes items that  |                    |                     |
| are leased, owned, or    |                    |                     |
| otherwise acquired by    |                    |                     |
| the Contractor without   |                    |                     |
| reimbursement from the   |                    |                     |
| Government. The ATV does |                    |                     |
| not include any          |                    |                     |
| Government-furnished or  |                    |                     |
| institutionally-provided |                    |                     |
| property or equipment,   |                    |                     |
| any infrastructure items |                    |                     |
| (for which title resides |                    |                     |
| with the Government),    |                    |                     |
| and any ODIN catalog     |                    |                     |
| products and services    |                    |                     |
| (except where otherwise  |                    |                     |
| bilaterally agreed upon  |                    |                     |
| under a given Delivery   |                    |                     |
| Order).                  |                    |                     |
|                          |                    |                     |
| The ATV report applies   |                    |                     |
| to all seat categories   |                    |                     |
| of ODIN services         |                    |                     |
| (desktop, server,        |                    |                     |
| communication). In       |                    |                     |
| preparing the ATV, the   |                    |                     |
| attached table           |                    |                     |
| identifies specific      |                    |                     |
| items that shall be      |                    |                     |
| considered but is not    |                    |                     |
| all-inclusive. The ATV   |                    |                     |
| Report shall contain     |                    |                     |
| descriptions and         |                    |                     |
| quantities of all        |                    |                     |
| hardware, (desktops,     |                    |                     |
| servers, phones,         |                    |                     |
| peripherals, etc),       |                    |                     |
| software (desktop,       |                    |                     |
| server and diagnostic),  |                    |                     |
| all infrastructure       |                    |                     |
| hardware and software    |                    |                     |
| components,              |                    |                     |
| communication assets,    |                    |                     |
| and any other assets     |                    |                     |
| used to provide ODIN     |                    |                     |
| seat services under the  |                    |                     |
| delivery order.          |                    |                     |
|                          |                    |                     |
| Hardware items are to be |                    |                     |
| separately listed in the |                    |                     |
| report with a unique     |                    |                     |
| identification number    |                    |                     |
| (such as a serial number |                    |                     |
| or an ODIN property      |                    |                     |
| number). For items that  |                    |                     |
| have no unique           |                    |                     |
| identification number    |                    |                     |
| the Contractor shall     |                    |                     |
| provide a means of       |                    |                     |
| identification for       |                    |                     |
| listing them in the      |                    |                     |
| report.                  |                    |                     |
+--------------------------+--------------------+---------------------+

+------------------------+--------------+-----------------------------+
| **NATIONAL AERONAUTICS | **[DATA]{.   | # CONTRACT #: NAS5-98140    |
| AND SPACE              | underline}** |                             |
| ADMINISTRATION**       |              | #                           |
|                        | **[RE        |                             |
| **Goddard Space Flight | QUIREMENT]{. | **DRD #: ODIN- 1A Page 2 of |
| Center**               | underline}** | 2**                         |
|                        |              |                             |
| **Greenbelt, MD        | ##           |                             |
| 20771**                |  DESCRIPTION |                             |
+------------------------+--------------+-----------------------------+
| **PREPARATION          |              |                             |
| INFORMATION**:         |              |                             |
| (continued)            |              |                             |
|                        |              |                             |
| For assets that use    |              |                             |
| the initial purchase   |              |                             |
| price as the basis for |              |                             |
| calculating the ATV,   |              |                             |
| the Report shall       |              |                             |
| include the following  |              |                             |
| information for each   |              |                             |
| item: Item Name, Item  |              |                             |
| Seat Type, Item        |              |                             |
| Description, Unique ID |              |                             |
| Number, Purchase date, |              |                             |
| Initial Purchase       |              |                             |
| Price, and Projected   |              |                             |
| undepreciated Value.   |              |                             |
| For identical items    |              |                             |
| purchased at the same  |              |                             |
| time and price, the    |              |                             |
| ATV may bundle these   |              |                             |
| into one listing. The  |              |                             |
| specific content and   |              |                             |
| format of the ATV      |              |                             |
| Report will be         |              |                             |
| bilaterally agreed     |              |                             |
| upon within the DOSP   |              |                             |
| negotiation. In        |              |                             |
| addition, the Report   |              |                             |
| shall provide a        |              |                             |
| separate listing of    |              |                             |
| Catalog items but the  |              |                             |
| values of these items  |              |                             |
| are not to be included |              |                             |
| in the ATV. The asset  |              |                             |
| transition value of    |              |                             |
| catalog items shall be |              |                             |
| included in the        |              |                             |
| catalog price of the   |              |                             |
| item (except where     |              |                             |
| otherwise bilaterally  |              |                             |
| agreed upon under a    |              |                             |
| given Delivery Order). |              |                             |
|                        |              |                             |
| The ATV Reports shall  |              |                             |
| be submitted           |              |                             |
| electronically be in   |              |                             |
| MS Excel format.       |              |                             |
|                        |              |                             |
| (end)                  |              |                             |
+------------------------+--------------+-----------------------------+

DRD-ODIN-1A

+---------------+------------------------------------------------------+
| > **Seat      | ### *List of asset                                   |
| > Category**  | s that shall be considered for inclusion in the ATV* |
+---------------+------------------------------------------------------+
| #             |                                                      |
+---------------+------------------------------------------------------+
| # Desktop     | > Hardware                                           |
+---------------+------------------------------------------------------+
|               | > System Software licenses                           |
+---------------+------------------------------------------------------+
|               | > Application Software licenses                      |
+---------------+------------------------------------------------------+
|               | > Un-expired maintenance agreements                  |
+---------------+------------------------------------------------------+
|               | > Hardware and software used to provide              |
|               | > Center-Standard Storage and/or Center-Standard     |
|               | > e-Mail Storage                                     |
+---------------+------------------------------------------------------+
|               | > Hardware and software used for System              |
|               | > Administration of e-Mail and domain name services  |
+---------------+------------------------------------------------------+
|               | > Hardware and software for printers and other items |
|               | > provided under Shared Peripheral Services          |
+---------------+------------------------------------------------------+
|               | > Hardware used to provide any Laptop Loaner Pool    |
|               | > services                                           |
+---------------+------------------------------------------------------+
|               | > Hardware and software used to provide Local Backup |
|               | > services                                           |
+---------------+------------------------------------------------------+
|               | > Hardware and software used to provide Desktop      |
|               | > Conferencing services                              |
+---------------+------------------------------------------------------+
|               |                                                      |
+---------------+------------------------------------------------------+
| # Server      | > Hardware                                           |
+---------------+------------------------------------------------------+
|               | > System and "back office" software licenses         |
+---------------+------------------------------------------------------+
|               | > Hardware and software used to provide necessary    |
|               | > Storage Volume                                     |
+---------------+------------------------------------------------------+
|               | > Un-expired maintenance agreements                  |
+---------------+------------------------------------------------------+
|               | > Hardware and software used to provide              |
|               | > Backup/Restore services                            |
+---------------+------------------------------------------------------+
|               |                                                      |
+---------------+------------------------------------------------------+
| #             | > Hardware                                           |
| Communication |                                                      |
+---------------+------------------------------------------------------+
| #             | > Un-expired maintenance agreements                  |
+---------------+------------------------------------------------------+
| #             |                                                      |
+---------------+------------------------------------------------------+
| # Telephonic  | > Telephone instruments                              |
+---------------+------------------------------------------------------+
|               |                                                      |
+---------------+------------------------------------------------------+
| **FAX**       | > Fax hardware and software                          |
+---------------+------------------------------------------------------+
|               |                                                      |
+---------------+------------------------------------------------------+
| > **AR**      | > Base station and handsets for Administrative Radio |
|               | > services                                           |
+---------------+------------------------------------------------------+
| #####         | > Portable, mobile, and base stations for AR         |
|               | > services, including antennas                       |
+---------------+------------------------------------------------------+
|               | > Radios without the Government frequencies, where   |
|               | > applicable                                         |
+---------------+------------------------------------------------------+
|               | > Hardware and software used for system              |
|               | > administration of ARs and Nets                     |
+---------------+------------------------------------------------------+
|               | > Hardware used to provide any Radio Loaner Pool     |
|               | > services                                           |
+---------------+------------------------------------------------------+
| ######        |                                                      |
+---------------+------------------------------------------------------+
| ###           | > Hardware and software used for system              |
| ### **Video** | > administration of the video network                |
+---------------+------------------------------------------------------+
| #####         |                                                      |
+---------------+------------------------------------------------------+
| ##### LAN     | > Hardware and software used for system              |
|               | > administration of LANs                             |
+---------------+------------------------------------------------------+
| #####         |                                                      |
+---------------+------------------------------------------------------+
| ##### RC      | > Hardware and software used for system              |
|               | > administration of the Remote Telecommunication     |
|               | > Service                                            |
+---------------+------------------------------------------------------+
| #####         |                                                      |
+---------------+------------------------------------------------------+
| ##### PA      | > Hardware and software used for system              |
|               | > administration of the Public Address Service       |
+---------------+------------------------------------------------------+