November 16, 2001

TO: Distribution

FROM: Code AO/Chief Information Officer

Code J/Associate Administrator for Management Systems

Code X/Associate Administrator for Security Management

and Safeguards

SUBJECT: NASA Web Site Registration and Internet Publishing Content

Guidelines

In light of the terrorist attacks of September 11, 2001, and the
possibilities for further terrorist activity in their aftermath, Federal
agencies must increase protection, not only of their personnel but also
of their critical systems, facilities, stockpiles, and other assets from
security breaches and harm as well as from their potential use as
weapons in and of themselves. Such efforts include the protection of any
related agency information. Therefore, NASA is taking steps to ensure
that its approach to the electronic dissemination of such information is
appropriate.

The steps outlined below are consistent with actions taken by other
Federal agencies, and are considered prudent to safeguard NASA\'s
employees and infrastructure.

1.  Effective immediately, access to public Web sites from the Internet
    shall be blocked for all unapproved sites residing on NASA networks.

2.  Until a site has been registered, reviewed and approved, access to
    unregistered and unapproved sites will be limited to the NASA
    network domain (\"nasa.gov\") only.

3.  Public access will remain for those sites already designated for the
    public, such as the NASA Home Page, but some links may become
    inaccessible until approved. Outbound Internet connections are not
    affected by this change.

4.  Procurement Web sites/pages that have not been reviewed and approved
    may be blocked with the concurrence of the Agency Office of
    Procurement. Procurement Web sites/pages made publicly available 120
    days after the date of this memorandum are subject to the
    registration and approval process as set forth herein.

Effective immediately, Enterprise and Center CIO's will work with Center
NASA Officials Responsible for Content and Web site curators to
implement a Web content management process to ensure that the
information contained on all NASA Web sites are suitable for public
access. For these purposes, the following definitions are provided:

-   \"Information\" is text, graphics, photos, or imagery of all types.

-   \"Web site\" is a logical collection of web pages hierarchically
    structured under the same Internet/HTTP domain name. A non-working
    example is \"<http://www.hq.nasa.gov/WWW/yoursite-directory-name>.\"

```{=html}
<!-- -->
```
-   \"Publicly-accessible web site\" is any web site that can be reached
    from outside the NASA.gov domain by the general public without
    restrictions.

-   \"NASA-only Web site\" is any website that accessible to only those
    within the NASA.gov domain. This includes access by NASA Centers
    other than your own.

```{=html}
<!-- -->
```
-   \"Web site curator\" is a person or group responsible for
    developing, deploying, and maintaining a Web site.

-   \"NASA Official Responsible for Content\" is a NASA civil service
    employee accountable for reviewing and approving the accuracy,
    timeliness, and appropriateness of information, including links,
    contained within the Web site.

```{=html}
<!-- -->
```
-   
-   

Several Center CIO's have already developed a Center process for Web
content evaluation and registration (including Ames Research Center,
Glenn Research Center, and Johnson Space Center). We have incorporated
several aspects of these content review concepts in our guidelines. At a
minimum, Center processes must include:

-   The NASA Officials Responsible for Content must register all of
    their Web sites with the office designated by the Center
    registration process.

```{=html}
<!-- -->
```
-   Each Web site that will be publicly accessible must be reviewed for
    appropriate content and approved by the respective line and
    Directorate Management.

-   The Center CIO or a delegated representative will have the final
    approval authority. (Note that the Office of Inspector General (OIG)
    or a designated representative will have final approval authority
    for the OIG public Web sites to maintain the integrity of the OIG\'s
    independence.)

-   Center CIO's are accountable for:

(1) establishing a process to implement these guidelines; and,

(2) monitoring the process to ensure on-going appropriate and thorough
    Web site reviews compliant with the process.

> The Office of the CIO will work with the Enterprise and Center CIO's
> to establish meaningful metrics which ensure the protection of NASA\'s
> information disseminated electronically.

-   

```{=html}
<!-- -->
```
-   

```{=html}
<!-- -->
```
-   

```{=html}
<!-- -->
```
-   

```{=html}
<!-- -->
```
-   
-   
-   

Section 5.1 of the enclosed Internet Publishing Content Guidelines
identifies categories of information that must not be published via the
Internet and provides a criteria checklist for Web site review and
approval of information to be made available outside of the nasa.gov
domain. This list will be updated as the Agency deems appropriate. Be
sure to check the latest document version posted to the NASA CIO\'s
internal website at
<http://www.hq.nasa.gov/office/codea/codeao/its2.html> before performing
a site review. Center CIO's must contact the Office of the CIO for a
waiver if a Center wishes to deviate from these criteria checklists.

It is understood that these actions will have an impact on many
activities across the Agency; however, this action is considered prudent
and necessary given the present threat conditions. This policy has been
coordinated with the Agency Office of General Counsel and the Freedom of
Information Act Officer as well as with others across the Agency. We are
sure that you will support our efforts to safeguard NASA and its
employees and on-site contractors. We encourage each Center CIO to work
with their Enterprise CIO, Center managers, Center IT Security Managers,
and Center Security Officials to accommodate critical situations on a
case by case basis. Additionally, note that we are working with the
Agency Office of Procurement towards sensitizing NASA contractors to our
web content concerns.

Please note that the restriction on internal Center-specific policies
and procedures listed in Section 5.1 of the guidelines is intended to be
only temporary. In keeping with NASA\'s philosophy to serve the public
and share information to the greatest extent reasonable, we are
developing a procedure to make appropriate Center policies and
procedures publicly accessible once again. These procedures will be
forthcoming soon in a subsequent memorandum.

If you have any questions or concerns regarding these guidelines, please
contact Dabney Hibbert, of the Office of the CIO, at 202-358-1377.

(signed by) (signed by) (signed by)

Lee B. Holcomb Jeffrey E. Sutton David A. Saleeba

Enclosure

[Distribution:]{.underline}

[Officials-in-Charge of Headquarters Offices:]{.underline}

AI/Dr. Mulville

AA/Mr. Stadd

AB/Mr. Christensen

AC/Gen. Armstrong

A-1/Dr. Blumberg

AE/Mr. Keegan

AJ/Mr. Tam

AM/Dr. Williams

AS/Dr. Olsen

B/Mr. Varholy (Acting)

C/Mr. Sullivan (Acting)

E/Mr. Reese

F/Ms. Novak

G/Mr. Frankle

H/Mr. Luedtke

I/Mr. Schumacher

K/Mr. Thomas

L/Mr. Bingham (Acting)

M/Mr. Readdy (Acting)

P/Mr. Mahone (Acting)

Q/Mr. Gregory

R/Mr. Venneri

S/Dr. Weiler

U/Dr. Olsen (Acting)

W/Ms. Gross

Y/Dr. Asrar

[Directors, NASA Centers]{.underline}:

ARC/Dr. McDonald

DFRC/Mr. Petersen

GRC/Mr. Campbell

GSFC/Mr. Diaz

JSC/Mr. Estess (Acting)

KSC/Mr. Bridges

LaRC/Dr. Creedon

MSFC/Mr. Stephenson

SSC/Mr. Craig (Acting)

[Director, Jet Propulsion Laboratory]{.underline}:

Dr. Elachi

Electronic Copies:

[IT Investment Council:]{.underline}

AE/Mr. Keegan

B/Mr. Varholy

C/Mr. Christensen

J/Mr. Sutton

M/Mr. Readdy

R/Mr. Reck

S/Dr. Huckins

Y/Mr. Luther

ARC/Dr. Berry

GSFC/Mr. Townsend

JSC/Mr. Newberry

MSFC/Mr. Kennedy

[Enterprise CIO\'s:]{.underline}

M-2/Mr. Fishkind

RS/Mr. Minarich (Acting)

SR/Mr. Bredekamp

UG/Mr. Wargo

YB/Ms. Sample

[Center CIO\'s:]{.underline}

HQ/Ms. Daniels-Gibson

ARC/Mr. Santiago

DFRC/Mr. Hornstein

GRC/Dr. Pillay

GSFC/Dr. Halem

JSC/Ms. Carter

KSC/Mr. Kerr

LaRC/Ms. Dunnington

MSFC/Ms. Cloud

SSC/Mr. Matherly

[JPL CIO:]{.underline}

Dr. Renfrow