+---------+-----+----------------------+---------+---+---+---+---------+
| **[NASA |     |                      |         |   |   |   |         |
| Int     |     |                      |         |   |   |   |         |
| egrated |     |                      |         |   |   |   |         |
| S       |     |                      |         |   |   |   |         |
| ervices |     |                      |         |   |   |   |         |
| Network |     |                      |         |   |   |   |         |
| (NISN)] |     |                      |         |   |   |   |         |
| {.small |     |                      |         |   |   |   |         |
| caps}** |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
| **[     |     |                      |         |   |   |   |         |
| Premium |     |                      |         |   |   |   |         |
| Service |     |                      |         |   |   |   |         |
| (PIP) / |     |                      |         |   |   |   |         |
| S       |     |                      |         |   |   |   |         |
| tandard |     |                      |         |   |   |   |         |
| Service |     |                      |         |   |   |   |         |
| (SIP)]  |     |                      |         |   |   |   |         |
| {.small |     |                      |         |   |   |   |         |
| caps}** |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 1\.     |     | **[Access Control    |         |   |   | 2 |         |
| CO      |     | Risk                 |         |   |   | \ |         |
| MPLETED |     | Chec                 |         |   |   | . |         |
| BY:     |     | klist]{.smallcaps}** |         |   |   | D |         |
|         |     |                      |         |   |   | A |         |
|         |     |                      |         |   |   | T |         |
|         |     |                      |         |   |   | E |         |
|         |     |                      |         |   |   | : |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| NOTE:   |     |                      |         |   |   |   |         |
| The     |     |                      |         |   |   |   |         |
| term    |     |                      |         |   |   |   |         |
| \"Info  |     |                      |         |   |   |   |         |
| rmation |     |                      |         |   |   |   |         |
| Tec     |     |                      |         |   |   |   |         |
| hnology |     |                      |         |   |   |   |         |
| (IT)    |     |                      |         |   |   |   |         |
| res     |     |                      |         |   |   |   |         |
| ource\" |     |                      |         |   |   |   |         |
| refers  |     |                      |         |   |   |   |         |
| to      |     |                      |         |   |   |   |         |
| \"data  |     |                      |         |   |   |   |         |
| and     |     |                      |         |   |   |   |         |
| infor   |     |                      |         |   |   |   |         |
| mation, |     |                      |         |   |   |   |         |
| com     |     |                      |         |   |   |   |         |
| puters, |     |                      |         |   |   |   |         |
| an      |     |                      |         |   |   |   |         |
| cillary |     |                      |         |   |   |   |         |
| equ     |     |                      |         |   |   |   |         |
| ipment, |     |                      |         |   |   |   |         |
| so      |     |                      |         |   |   |   |         |
| ftware, |     |                      |         |   |   |   |         |
| f       |     |                      |         |   |   |   |         |
| irmware |     |                      |         |   |   |   |         |
| and     |     |                      |         |   |   |   |         |
| similar |     |                      |         |   |   |   |         |
| pr      |     |                      |         |   |   |   |         |
| oducts, |     |                      |         |   |   |   |         |
| fac     |     |                      |         |   |   |   |         |
| ilities |     |                      |         |   |   |   |         |
| that    |     |                      |         |   |   |   |         |
| house   |     |                      |         |   |   |   |         |
| such    |     |                      |         |   |   |   |         |
| res     |     |                      |         |   |   |   |         |
| ources, |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| ervices |     |                      |         |   |   |   |         |
| in      |     |                      |         |   |   |   |         |
| cluding |     |                      |         |   |   |   |         |
| re      |     |                      |         |   |   |   |         |
| sources |     |                      |         |   |   |   |         |
| used    |     |                      |         |   |   |   |         |
| for the |     |                      |         |   |   |   |         |
| acqui   |     |                      |         |   |   |   |         |
| sition, |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| torage, |     |                      |         |   |   |   |         |
| manipu  |     |                      |         |   |   |   |         |
| lation, |     |                      |         |   |   |   |         |
| mana    |     |                      |         |   |   |   |         |
| gement, |     |                      |         |   |   |   |         |
| mo      |     |                      |         |   |   |   |         |
| vement, |     |                      |         |   |   |   |         |
| c       |     |                      |         |   |   |   |         |
| ontrol, |     |                      |         |   |   |   |         |
| d       |     |                      |         |   |   |   |         |
| isplay, |     |                      |         |   |   |   |         |
| swi     |     |                      |         |   |   |   |         |
| tching, |     |                      |         |   |   |   |         |
| inter   |     |                      |         |   |   |   |         |
| change, |     |                      |         |   |   |   |         |
| transm  |     |                      |         |   |   |   |         |
| ission, |     |                      |         |   |   |   |         |
| or      |     |                      |         |   |   |   |         |
| re      |     |                      |         |   |   |   |         |
| ception |     |                      |         |   |   |   |         |
| of      |     |                      |         |   |   |   |         |
| data.   |     |                      |         |   |   |   |         |
| This    |     |                      |         |   |   |   |         |
| i       |     |                      |         |   |   |   |         |
| ncludes |     |                      |         |   |   |   |         |
| tel     |     |                      |         |   |   |   |         |
| ecommun |     |                      |         |   |   |   |         |
| ication |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| ystems, |     |                      |         |   |   |   |         |
| network |     |                      |         |   |   |   |         |
| systems |     |                      |         |   |   |   |         |
| and     |     |                      |         |   |   |   |         |
| human   |     |                      |         |   |   |   |         |
| resou   |     |                      |         |   |   |   |         |
| rces.\" |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| **      |     |                      |         |   |   |   |         |
| SECTION |     |                      |         |   |   |   |         |
| 1:      |     |                      |         |   |   |   |         |
| C       |     |                      |         |   |   |   |         |
| ONFIGUR |     |                      |         |   |   |   |         |
| ATION** |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 4\.     |     |                      | 5\.     |   |   |   |         |
| Name    |     |                      | Mission |   |   |   |         |
| the IT  |     |                      | desc    |   |   |   |         |
| re      |     |                      | ription |   |   |   |         |
| source: |     |                      | of this |   |   |   |         |
|         |     |                      | IT      |   |   |   |         |
|         |     |                      | re      |   |   |   |         |
|         |     |                      | source: |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 6\.     |     |                      |         |   |   |   |         |
| P       |     |                      |         |   |   |   |         |
| hysical |     |                      |         |   |   |   |         |
| desc    |     |                      |         |   |   |   |         |
| ription |     |                      |         |   |   |   |         |
| of this |     |                      |         |   |   |   |         |
| IT      |     |                      |         |   |   |   |         |
| r       |     |                      |         |   |   |   |         |
| esource |     |                      |         |   |   |   |         |
| re      |     |                      |         |   |   |   |         |
| quired. |     |                      |         |   |   |   |         |
| Attach  |     |                      |         |   |   |   |         |
| a       |     |                      |         |   |   |   |         |
| legible |     |                      |         |   |   |   |         |
| block   |     |                      |         |   |   |   |         |
| dia     |     |                      |         |   |   |   |         |
| gram(s) |     |                      |         |   |   |   |         |
| that    |     |                      |         |   |   |   |         |
| ide     |     |                      |         |   |   |   |         |
| ntifies |     |                      |         |   |   |   |         |
| PCs,    |     |                      |         |   |   |   |         |
| workst  |     |                      |         |   |   |   |         |
| ations, |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| ervers, |     |                      |         |   |   |   |         |
| b       |     |                      |         |   |   |   |         |
| ridges, |     |                      |         |   |   |   |         |
| r       |     |                      |         |   |   |   |         |
| outers, |     |                      |         |   |   |   |         |
| ga      |     |                      |         |   |   |   |         |
| teways, |     |                      |         |   |   |   |         |
| fir     |     |                      |         |   |   |   |         |
| ewalls, |     |                      |         |   |   |   |         |
| e       |     |                      |         |   |   |   |         |
| xternal |     |                      |         |   |   |   |         |
| int     |     |                      |         |   |   |   |         |
| erfaces |     |                      |         |   |   |   |         |
| to the  |     |                      |         |   |   |   |         |
| System, |     |                      |         |   |   |   |         |
| and     |     |                      |         |   |   |   |         |
| conn    |     |                      |         |   |   |   |         |
| ections |     |                      |         |   |   |   |         |
| to      |     |                      |         |   |   |   |         |
| other   |     |                      |         |   |   |   |         |
| ne      |     |                      |         |   |   |   |         |
| tworks. |     |                      |         |   |   |   |         |
| These   |     |                      |         |   |   |   |         |
| d       |     |                      |         |   |   |   |         |
| iagrams |     |                      |         |   |   |   |         |
| should  |     |                      |         |   |   |   |         |
| i       |     |                      |         |   |   |   |         |
| ndicate |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| p       |     |                      |         |   |   |   |         |
| hysical |     |                      |         |   |   |   |         |
| l       |     |                      |         |   |   |   |         |
| ocation |     |                      |         |   |   |   |         |
| of each |     |                      |         |   |   |   |         |
| major   |     |                      |         |   |   |   |         |
| co      |     |                      |         |   |   |   |         |
| mponent |     |                      |         |   |   |   |         |
| of the  |     |                      |         |   |   |   |         |
| system. |     |                      |         |   |   |   |         |
| The     |     |                      |         |   |   |   |         |
| diagram |     |                      |         |   |   |   |         |
| should  |     |                      |         |   |   |   |         |
| also    |     |                      |         |   |   |   |         |
| show    |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| data    |     |                      |         |   |   |   |         |
| flows   |     |                      |         |   |   |   |         |
| with    |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| di      |     |                      |         |   |   |   |         |
| rection |     |                      |         |   |   |   |         |
| of      |     |                      |         |   |   |   |         |
| those   |     |                      |         |   |   |   |         |
| flows.  |     |                      |         |   |   |   |         |
| If      |     |                      |         |   |   |   |         |
| nec     |     |                      |         |   |   |   |         |
| essary, |     |                      |         |   |   |   |         |
| provide |     |                      |         |   |   |   |         |
| more    |     |                      |         |   |   |   |         |
| than    |     |                      |         |   |   |   |         |
| one     |     |                      |         |   |   |   |         |
| diagram |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 7\.     |     |                      |         |   |   |   |         |
| D       |     |                      |         |   |   |   |         |
| escribe |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| ecurity |     |                      |         |   |   |   |         |
| methods |     |                      |         |   |   |   |         |
| (both   |     |                      |         |   |   |   |         |
| h       |     |                      |         |   |   |   |         |
| ardware |     |                      |         |   |   |   |         |
| and     |     |                      |         |   |   |   |         |
| so      |     |                      |         |   |   |   |         |
| ftware) |     |                      |         |   |   |   |         |
| that    |     |                      |         |   |   |   |         |
| are in  |     |                      |         |   |   |   |         |
| place   |     |                      |         |   |   |   |         |
| to      |     |                      |         |   |   |   |         |
| protect |     |                      |         |   |   |   |         |
| this IT |     |                      |         |   |   |   |         |
| r       |     |                      |         |   |   |   |         |
| esource |     |                      |         |   |   |   |         |
| and     |     |                      |         |   |   |   |         |
| NISN.   |     |                      |         |   |   |   |         |
| If      |     |                      |         |   |   |   |         |
| fi      |     |                      |         |   |   |   |         |
| rewalls |     |                      |         |   |   |   |         |
| are     |     |                      |         |   |   |   |         |
| used,   |     |                      |         |   |   |   |         |
| what    |     |                      |         |   |   |   |         |
| com     |     |                      |         |   |   |   |         |
| ponents |     |                      |         |   |   |   |         |
| c       |     |                      |         |   |   |   |         |
| omprise |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| f       |     |                      |         |   |   |   |         |
| irewall |     |                      |         |   |   |   |         |
| design  |     |                      |         |   |   |   |         |
| (       |     |                      |         |   |   |   |         |
| Authent |     |                      |         |   |   |   |         |
| ication |     |                      |         |   |   |   |         |
| Server, |     |                      |         |   |   |   |         |
| Sc      |     |                      |         |   |   |   |         |
| reening |     |                      |         |   |   |   |         |
| Router, |     |                      |         |   |   |   |         |
| Bastion |     |                      |         |   |   |   |         |
| Host,   |     |                      |         |   |   |   |         |
| Appl    |     |                      |         |   |   |   |         |
| ication |     |                      |         |   |   |   |         |
| Proxy   |     |                      |         |   |   |   |         |
| Servers |     |                      |         |   |   |   |         |
| and/or  |     |                      |         |   |   |   |         |
| o       |     |                      |         |   |   |   |         |
| thers)? |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 8\.     |     |                      |         |   |   |   |         |
| I       |     |                      |         |   |   |   |         |
| dentify |     |                      |         |   |   |   |         |
| which   |     |                      |         |   |   |   |         |
| n       |     |                      |         |   |   |   |         |
| etworks |     |                      |         |   |   |   |         |
| or      |     |                      |         |   |   |   |         |
| systems |     |                      |         |   |   |   |         |
| (e.g.,  |     |                      |         |   |   |   |         |
| P       |     |                      |         |   |   |   |         |
| IP/SIP) |     |                      |         |   |   |   |         |
| this IT |     |                      |         |   |   |   |         |
| r       |     |                      |         |   |   |   |         |
| esource |     |                      |         |   |   |   |         |
| is      |     |                      |         |   |   |   |         |
| cu      |     |                      |         |   |   |   |         |
| rrently |     |                      |         |   |   |   |         |
| co      |     |                      |         |   |   |   |         |
| nnected |     |                      |         |   |   |   |         |
| to:     |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| PIP?    | S   |                      | In      |   | P |   |         |
|         | IP? |                      | ternet? |   | r |   |         |
|         |     |                      |         |   | í |   |         |
|         |     |                      |         |   | v |   |         |
|         |     |                      |         |   | a |   |         |
|         |     |                      |         |   | t |   |         |
|         |     |                      |         |   | e |   |         |
|         |     |                      |         |   | ? |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| Closed  |     |                      | Open    |   | R |   |         |
| IONet?  |     |                      | IONet?  |   | e |   |         |
|         |     |                      |         |   | s |   |         |
|         |     |                      |         |   | t |   |         |
|         |     |                      |         |   | r |   |         |
|         |     |                      |         |   | i |   |         |
|         |     |                      |         |   | c |   |         |
|         |     |                      |         |   | t |   |         |
|         |     |                      |         |   | e |   |         |
|         |     |                      |         |   | d |   |         |
|         |     |                      |         |   | I |   |         |
|         |     |                      |         |   | O |   |         |
|         |     |                      |         |   | N |   |         |
|         |     |                      |         |   | e |   |         |
|         |     |                      |         |   | t |   |         |
|         |     |                      |         |   | ? |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| Agency  |     |                      | Uni     |   |   |   |         |
| Center  |     |                      | versity |   |   |   |         |
| Local   |     |                      | LAN(s)? |   |   |   |         |
| Area    |     |                      |         |   |   |   |         |
| Network |     |                      | If yes, |   |   |   |         |
| (LAN)?  |     |                      | which?  |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| Intern  |     |                      | Local   |   | O |   |         |
| ational |     |                      | LANs?   |   | t |   |         |
| LANs?   |     |                      |         |   | h |   |         |
|         |     |                      |         |   | e |   |         |
|         |     |                      |         |   | r |   |         |
|         |     |                      |         |   | ? |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   | I |   |         |
|         |     |                      |         |   | d |   |         |
|         |     |                      |         |   | e |   |         |
|         |     |                      |         |   | n |   |         |
|         |     |                      |         |   | t |   |         |
|         |     |                      |         |   | i |   |         |
|         |     |                      |         |   | f |   |         |
|         |     |                      |         |   | y |   |         |
|         |     |                      |         |   | * |   |         |
|         |     |                      |         |   | * |   |         |
|         |     |                      |         |   | : |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   | * |   |         |
|         |     |                      |         |   | * |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| NOTE:   |     |                      |         |   |   |   |         |
| If you  |     |                      |         |   |   |   |         |
| have    |     |                      |         |   |   |   |         |
| systems |     |                      |         |   |   |   |         |
| co      |     |                      |         |   |   |   |         |
| nnected |     |                      |         |   |   |   |         |
| to PIP  |     |                      |         |   |   |   |         |
| or SIP, |     |                      |         |   |   |   |         |
| please  |     |                      |         |   |   |   |         |
| submit  |     |                      |         |   |   |   |         |
| a       |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| eparate |     |                      |         |   |   |   |         |
| ch      |     |                      |         |   |   |   |         |
| ecklist |     |                      |         |   |   |   |         |
| for     |     |                      |         |   |   |   |         |
| each    |     |                      |         |   |   |   |         |
| n       |     |                      |         |   |   |   |         |
| etwork. |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 9\. Is  |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| oftware |     |                      |         |   |   |   |         |
| deve    |     |                      |         |   |   |   |         |
| lopment |     |                      |         |   |   |   |         |
| system  |     |                      |         |   |   |   |         |
| or test |     |                      |         |   |   |   |         |
| eq      |     |                      |         |   |   |   |         |
| uipment |     |                      |         |   |   |   |         |
| for     |     |                      |         |   |   |   |         |
| this IT |     |                      |         |   |   |   |         |
| r       |     |                      |         |   |   |   |         |
| esource |     |                      |         |   |   |   |         |
| capable |     |                      |         |   |   |   |         |
| of      |     |                      |         |   |   |   |         |
| trans   |     |                      |         |   |   |   |         |
| mitting |     |                      |         |   |   |   |         |
| data    |     |                      |         |   |   |   |         |
| d       |     |                      |         |   |   |   |         |
| irectly |     |                      |         |   |   |   |         |
| or      |     |                      |         |   |   |   |         |
| ind     |     |                      |         |   |   |   |         |
| irectly |     |                      |         |   |   |   |         |
| over    |     |                      |         |   |   |   |         |
| SIP/PIP |     |                      |         |   |   |   |         |
| c       |     |                      |         |   |   |   |         |
| ircuits |     |                      |         |   |   |   |         |
| or      |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| ystems? |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 10\.    |     |                      |         |   |   |   |         |
| What    |     |                      |         |   |   |   |         |
| other   |     |                      |         |   |   |   |         |
| proje   |     |                      |         |   |   |   |         |
| cts/fac |     |                      |         |   |   |   |         |
| ilities |     |                      |         |   |   |   |         |
| are you |     |                      |         |   |   |   |         |
| inte    |     |                      |         |   |   |   |         |
| rfacing |     |                      |         |   |   |   |         |
| with?   |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 11\.    |     |                      |         |   |   |   |         |
| Will    |     |                      |         |   |   |   |         |
| laptop  |     |                      |         |   |   |   |         |
| co      |     |                      |         |   |   |   |         |
| mputers |     |                      |         |   |   |   |         |
| be used |     |                      |         |   |   |   |         |
| on this |     |                      |         |   |   |   |         |
| p       |     |                      |         |   |   |   |         |
| roject? |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 12\.    |     |                      |         |   |   |   |         |
| Will    |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| laptop  |     |                      |         |   |   |   |         |
| ever be |     |                      |         |   |   |   |         |
| co      |     |                      |         |   |   |   |         |
| nnected |     |                      |         |   |   |   |         |
| to the  |     |                      |         |   |   |   |         |
| n       |     |                      |         |   |   |   |         |
| etwork? |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 13\.    |     |                      |         |   |   |   |         |
| Has the |     |                      |         |   |   |   |         |
| laptop  |     |                      |         |   |   |   |         |
| been    |     |                      |         |   |   |   |         |
| scanned |     |                      |         |   |   |   |         |
| for     |     |                      |         |   |   |   |         |
| vu      |     |                      |         |   |   |   |         |
| lnerabi |     |                      |         |   |   |   |         |
| lities? |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 14\.    |     |                      |         |   |   |   |         |
| Does    |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| laptop  |     |                      |         |   |   |   |         |
| have    |     |                      |         |   |   |   |         |
| ant     |     |                      |         |   |   |   |         |
| i-virus |     |                      |         |   |   |   |         |
| so      |     |                      |         |   |   |   |         |
| ftware? |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 15\. Is |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| laptop  |     |                      |         |   |   |   |         |
| ever    |     |                      |         |   |   |   |         |
| co      |     |                      |         |   |   |   |         |
| nnected |     |                      |         |   |   |   |         |
| to      |     |                      |         |   |   |   |         |
| another |     |                      |         |   |   |   |         |
| network |     |                      |         |   |   |   |         |
| other   |     |                      |         |   |   |   |         |
| than    |     |                      |         |   |   |   |         |
| NISN?   |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 16\.    |     |                      |         |   |   |   |         |
| Are any |     |                      |         |   |   |   |         |
| of the  |     |                      |         |   |   |   |         |
| systems |     |                      |         |   |   |   |         |
| dua     |     |                      |         |   |   |   |         |
| l-boot? |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
| If yes, |     |                      |         |   |   |   |         |
| please  |     |                      |         |   |   |   |         |
| explain |     |                      |         |   |   |   |         |
| why a   |     |                      |         |   |   |   |         |
| du      |     |                      |         |   |   |   |         |
| al-boot |     |                      |         |   |   |   |         |
| system  |     |                      |         |   |   |   |         |
| is      |     |                      |         |   |   |   |         |
| re      |     |                      |         |   |   |   |         |
| quired: |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 17\.    |     |                      |         |   |   |   |         |
| Which   |     |                      |         |   |   |   |         |
| op      |     |                      |         |   |   |   |         |
| erating |     |                      |         |   |   |   |         |
| systems |     |                      |         |   |   |   |         |
| are     |     |                      |         |   |   |   |         |
| in      |     |                      |         |   |   |   |         |
| stalled |     |                      |         |   |   |   |         |
| on the  |     |                      |         |   |   |   |         |
| s       |     |                      |         |   |   |   |         |
| ystem's |     |                      |         |   |   |   |         |
| hard    |     |                      |         |   |   |   |         |
| drive?  |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 18\.    |     |                      |         |   |   |   |         |
| What is |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| primary |     |                      |         |   |   |   |         |
| op      |     |                      |         |   |   |   |         |
| erating |     |                      |         |   |   |   |         |
| system? |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 19\. If |     |                      |         |   |   |   |         |
| this is |     |                      |         |   |   |   |         |
| a new   |     |                      |         |   |   |   |         |
| conn    |     |                      |         |   |   |   |         |
| ection, |     |                      |         |   |   |   |         |
| will    |     |                      |         |   |   |   |         |
| you     |     |                      |         |   |   |   |         |
| need    |     |                      |         |   |   |   |         |
| con     |     |                      |         |   |   |   |         |
| nection |     |                      |         |   |   |   |         |
| to SIP? |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
| If yes, |     |                      |         |   |   |   |         |
| what    |     |                      |         |   |   |   |         |
| will be |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| d       |     |                      |         |   |   |   |         |
| uration |     |                      |         |   |   |   |         |
| of this |     |                      |         |   |   |   |         |
| conn    |     |                      |         |   |   |   |         |
| ection? |     |                      |         |   |   |   |         |
| Insert  |     |                      |         |   |   |   |         |
| answer  |     |                      |         |   |   |   |         |
| for     |     |                      |         |   |   |   |         |
| each    |     |                      |         |   |   |   |         |
| c       |     |                      |         |   |   |   |         |
| ategory |     |                      |         |   |   |   |         |
| below:  |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| Launch: |     |                      | Early   | L |   |   | Per     |
|         |     |                      | Orbit:  | o |   |   | manent: |
|         |     |                      |         | n |   |   |         |
|         |     |                      |         | g |   |   |         |
|         |     |                      |         | T |   |   |         |
|         |     |                      |         | e |   |   |         |
|         |     |                      |         | r |   |   |         |
|         |     |                      |         | m |   |   |         |
|         |     |                      |         | : |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 20\.    |     |                      |         |   |   |   |         |
| Where   |     |                      |         |   |   |   |         |
| will    |     |                      |         |   |   |   |         |
| this    |     |                      |         |   |   |   |         |
| con     |     |                      |         |   |   |   |         |
| nection |     |                      |         |   |   |   |         |
| be      |     |                      |         |   |   |   |         |
| made?   |     |                      |         |   |   |   |         |
| (e.g.,  |     |                      |         |   |   |   |         |
| VAFB,   |     |                      |         |   |   |   |         |
| JPL):   |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 21\. If |     |                      |         |   |   |   |         |
| this is |     |                      |         |   |   |   |         |
| a new   |     |                      |         |   |   |   |         |
| conn    |     |                      |         |   |   |   |         |
| ection, |     |                      |         |   |   |   |         |
| will    |     |                      |         |   |   |   |         |
| you     |     |                      |         |   |   |   |         |
| need    |     |                      |         |   |   |   |         |
| con     |     |                      |         |   |   |   |         |
| nection |     |                      |         |   |   |   |         |
| to the  |     |                      |         |   |   |   |         |
| PIP?    |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
| If yes, |     |                      |         |   |   |   |         |
| what    |     |                      |         |   |   |   |         |
| will be |     |                      |         |   |   |   |         |
| the     |     |                      |         |   |   |   |         |
| d       |     |                      |         |   |   |   |         |
| uration |     |                      |         |   |   |   |         |
| of this |     |                      |         |   |   |   |         |
| conn    |     |                      |         |   |   |   |         |
| ection? |     |                      |         |   |   |   |         |
| Insert  |     |                      |         |   |   |   |         |
| answer  |     |                      |         |   |   |   |         |
| for     |     |                      |         |   |   |   |         |
| each    |     |                      |         |   |   |   |         |
| c       |     |                      |         |   |   |   |         |
| ategory |     |                      |         |   |   |   |         |
| below:  |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| Launch: |     |                      | Early   | L |   |   | Per     |
|         |     |                      | Orbit:  | o |   |   | manent: |
|         |     |                      |         | n |   |   |         |
|         |     |                      |         | g |   |   |         |
|         |     |                      |         | T |   |   |         |
|         |     |                      |         | e |   |   |         |
|         |     |                      |         | r |   |   |         |
|         |     |                      |         | m |   |   |         |
|         |     |                      |         | : |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+
| 22\.    |     |                      |         |   |   |   |         |
| Where   |     |                      |         |   |   |   |         |
| will    |     |                      |         |   |   |   |         |
| this    |     |                      |         |   |   |   |         |
| con     |     |                      |         |   |   |   |         |
| nection |     |                      |         |   |   |   |         |
| be      |     |                      |         |   |   |   |         |
| made?   |     |                      |         |   |   |   |         |
| (e.g.,  |     |                      |         |   |   |   |         |
| VAFB,   |     |                      |         |   |   |   |         |
| JPL):   |     |                      |         |   |   |   |         |
|         |     |                      |         |   |   |   |         |
+---------+-----+----------------------+---------+---+---+---+---------+

+-----------------+-----------------+-----------------+-----------------+
| **CONTACT       |                 |                 |                 |
| INFORMATION**   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 23\. Identify   |                 |                 |                 |
| Federal Project |                 |                 |                 |
| M               |                 |                 |                 |
| anager/Division |                 |                 |                 |
| C               |                 |                 |                 |
| hief/Contractor |                 |                 |                 |
| Project Lead or |                 |                 |                 |
| Higher Level    |                 |                 |                 |
| Manager. If the |                 |                 |                 |
| contact does    |                 |                 |                 |
| not match       |                 |                 |                 |
| contacts listed |                 |                 |                 |
| with the NISN   |                 |                 |                 |
| security plan   |                 |                 |                 |
| then update     |                 |                 |                 |
| plan            |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **[Individual   | **[Title        | **[Organization | **[Phone        |
| ]{.underline}** | ]{.underline}** | ]{.underline}** | \#              |
|                 |                 |                 | ]{.underline}** |
| **     **       | **     **       | **     **       |                 |
|                 |                 |                 | **     **       |
| **     **       | **     **       | **     **       |                 |
|                 |                 |                 | **     **       |
| **     **       | **     **       | **     **       |                 |
|                 |                 |                 | **     **       |
+-----------------+-----------------+-----------------+-----------------+
| 24\. Identify   |                 |                 |                 |
| by title or     |                 |                 |                 |
| position the    |                 |                 |                 |
| individuals     |                 |                 |                 |
| responsible for |                 |                 |                 |
| security of the |                 |                 |                 |
| IT resource,    |                 |                 |                 |
| including the   |                 |                 |                 |
| System          |                 |                 |                 |
| Administrators, |                 |                 |                 |
| Network         |                 |                 |                 |
| Administrators  |                 |                 |                 |
| and Security    |                 |                 |                 |
| Officer. If the |                 |                 |                 |
| contact does    |                 |                 |                 |
| not match       |                 |                 |                 |
| contacts listed |                 |                 |                 |
| with the NISN   |                 |                 |                 |
| security plan   |                 |                 |                 |
| then update     |                 |                 |                 |
| plan.           |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **[Individual   | **[Title        | **[Organization | **[Phone        |
| ]{.underline}** | ]{.underline}** | ]{.underline}** | \#              |
|                 |                 |                 | ]{.underline}** |
| **     **       | **     **       | **     **       |                 |
|                 |                 |                 | **     **       |
| **     **       | **     **       | **     **       |                 |
|                 |                 |                 | **     **       |
| **     **       | **     **       | **     **       |                 |
|                 |                 |                 | **     **       |
+-----------------+-----------------+-----------------+-----------------+

<table>
<colgroup>
<col style="width: 25%" />
<col style="width: 3%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 3%" />
<col style="width: 11%" />
<col style="width: 7%" />
<col style="width: 1%" />
<col style="width: 1%" />
<col style="width: 5%" />
<col style="width: 8%" />
<col style="width: 25%" />
</colgroup>
<tbody>
<tr class="odd">
<td colspan="12">SECTION 2: INFORMATION TECHNOLOGY (IT) SECURITY
CHECKLIST</td>
</tr>
<tr class="even">
<td colspan="12"><ol type="1">
<li><p>Assignment of IT Security Responsibilities:</p></li>
</ol></td>
</tr>
<tr class="odd">
<td colspan="12"><blockquote>
<p>1A. Has this project assigned a security officer in writing? </p>
</blockquote></td>
</tr>
<tr class="even">
<td colspan="12"><blockquote>
<p>1B. Is responsibility for IT security included in the job description
of the security officer? </p>
</blockquote></td>
</tr>
<tr class="odd">
<td colspan="12">2. Documentation:</td>
</tr>
<tr class="even">
<td colspan="12"><blockquote>
<p>2A. Do the following required documents exist for this project?
Answer Yes or No below:</p>
</blockquote></td>
</tr>
<tr class="odd">
<td colspan="12"><ul>
<li><p>Continuity of Operations Plan (COOP)? </p></li>
</ul></td>
</tr>
<tr class="even">
<td colspan="12"><ul>
<li><p>Security Plan? </p></li>
</ul></td>
</tr>
<tr class="odd">
<td colspan="12"><ul>
<li><p>Contingency/Disaster Recovery Plan? </p></li>
</ul></td>
</tr>
<tr class="even">
<td colspan="12"><ul>
<li><p>Certification and Accreditation document? </p></li>
</ul></td>
</tr>
<tr class="odd">
<td colspan="12"><ul>
<li><p>Risk Mitigation/Assessment Plan? </p></li>
</ul></td>
</tr>
<tr class="even">
<td colspan="12">NOTE: The Security Team will request to see signed
copies of authorization letters.</td>
</tr>
<tr class="odd">
<td colspan="12">3. Authorization to process:</td>
</tr>
<tr class="even">
<td colspan="12">NOTE: Each system that processes information on behalf
of the Federal Government must have written authorization and periodic
re-authorization to process by the appropriate line management official.
This item is not applicable to International partners.</td>
</tr>
<tr class="odd">
<td colspan="12"><p>3A. Has a Federal management official authorized
processing for each system, network and telecommunication system in the
IT resource? </p>
<p>If yes, please list this official:      </p>
<p>     </p>
<p>     </p></td>
</tr>
<tr class="even">
<td colspan="12">4. Rules of Behavior:</td>
</tr>
<tr class="odd">
<td colspan="12"><p>4A. Have rules of behavior been established and
distributed to all users? </p>
<p>If different than those given in the acceptable use policy and routed
data policy of the NISN Services Document, please provide a
copy.</p></td>
</tr>
<tr class="even">
<td colspan="12">4B. Are the rules of behavior signed by the user and
kept on file? </td>
</tr>
<tr class="odd">
<td colspan="12">5. Security Awareness Training:</td>
</tr>
<tr class="even">
<td colspan="12">5A. Is initial training provided to all new employees
within 30 days of employment? </td>
</tr>
<tr class="odd">
<td colspan="12">5B. Is system or network-specific security training
provided for users? </td>
</tr>
<tr class="even">
<td colspan="12">5C. Is training provided annually or whenever there is
a significant change in the IT resources, environment or procedures?
</td>
</tr>
<tr class="odd">
<td colspan="12">5D. Are new users required to have security training
prior to having an account? </td>
</tr>
<tr class="even">
<td colspan="12">5E. Is a signed acknowledgement of training kept on
file for 2 years? </td>
</tr>
<tr class="odd">
<td colspan="12">6. Incident Reporting and Handling:</td>
</tr>
<tr class="even">
<td colspan="12">6A. Has an incident response procedure been provided to
each system and network administrator? </td>
</tr>
<tr class="odd">
<td colspan="12">6B. Has the NASA Automated Security Incident Response
Capability (NASIRC) or other appropriate incidence response contact been
provided to each system and network administrator? </td>
</tr>
<tr class="even">
<td colspan="12">7. Logon Banner:</td>
</tr>
<tr class="odd">
<td colspan="12">Note: This item is applicable to all NASA-owned and
NASA-funded IT systems.</td>
</tr>
<tr class="even">
<td colspan="12">7A. Has the NASA required logon banner been installed
on each system? </td>
</tr>
<tr class="odd">
<td colspan="12">7B. Has the NASA required logon banner been installed
on each of the following? Answer Y or N</td>
</tr>
<tr class="even">
<td colspan="5">File Transfer Protocol (FTP): </td>
<td colspan="3">telnet: </td>
<td colspan="4">Hypertext Transfer Protocol (HTTP): </td>
</tr>
<tr class="odd">
<td colspan="3">console logons: </td>
<td colspan="4">Security Shell (SSH): </td>
<td colspan="5">other interactive network access: </td>
</tr>
<tr class="even">
<td colspan="12">8. International Sites:</td>
</tr>
<tr class="odd">
<td colspan="12"><p>8A. Is your facility located in an “International”
location? </p>
<blockquote>
<p>If yes, what is the location of your facility?      </p>
</blockquote></td>
</tr>
<tr class="even">
<td colspan="12"><p>8B. Do you have a current International agreement?
</p>
<blockquote>
<p>If yes, please provide a copy of the agreement.</p>
</blockquote></td>
</tr>
<tr class="odd">
<td colspan="12">9. Personnel Screening:</td>
</tr>
<tr class="even">
<td colspan="12">9A. If the project is not run by NASA personnel, what
personnel screening does your company/organization provide?      </td>
</tr>
<tr class="odd">
<td colspan="12">9B. Do your personnel have at least a National Agency
Check (NAC)? </td>
</tr>
<tr class="even">
<td colspan="12">9C. Do you have any foreign nationals working on this
project? </td>
</tr>
<tr class="odd">
<td colspan="12">9D. Have the names of the foreign nationals without
green cards been submitted to NASA Headquarters? </td>
</tr>
<tr class="even">
<td colspan="12">10. Configuration Management (CM):</td>
</tr>
<tr class="odd">
<td colspan="12">10A. Is a CM process part of the life cycle for this
project? </td>
</tr>
<tr class="even">
<td colspan="12">10B. Does CM ensure only authorized software and
configurations are installed? </td>
</tr>
<tr class="odd">
<td colspan="12">11. Software Protection:</td>
</tr>
<tr class="even">
<td colspan="12">11A. Does the project comply with the Host Center
software use policy? </td>
</tr>
<tr class="odd">
<td colspan="12">11B. Have personnel been briefed on the proper steps to
take whenever they encounter a virus? </td>
</tr>
<tr class="even">
<td colspan="12">11C. Have personnel been briefed on their
responsibilities regarding the installation of licensed software on IT
resources? </td>
</tr>
<tr class="odd">
<td colspan="12">11D. Do you use the following on your IT resources that
are connected to NISN? Answer Y or N:</td>
</tr>
<tr class="even">
<td><blockquote>
<p>X-terminals? </p>
</blockquote></td>
<td colspan="5"><blockquote>
<p>FTP? </p>
</blockquote></td>
<td colspan="5"><blockquote>
<p>Telnet? </p>
</blockquote></td>
<td><blockquote>
<p>E-mail? </p>
</blockquote></td>
</tr>
<tr class="odd">
<td colspan="12">11E. Has anti-virus software been installed on all
personal computers? </td>
</tr>
<tr class="even">
<td colspan="12">11F. How frequently is the anti-virus software updated?
Interval:      </td>
</tr>
<tr class="odd">
<td colspan="12">11G. How frequently is the anti-virus signature
updated? Interval:      </td>
</tr>
<tr class="even">
<td colspan="12">11H. How long does it take to remove personnel network
access if a reprimand or termination is approved?      </td>
</tr>
<tr class="odd">
<td colspan="12">12. Security Software</td>
</tr>
<tr class="even">
<td colspan="12"><p>12A. What host vulnerability assessment software is
being used? LIST: </p>
<p>     </p></td>
</tr>
<tr class="odd">
<td colspan="12">12B. Have the identified vulnerabilities been fixed?
</td>
</tr>
<tr class="even">
<td colspan="12">12C. How frequently is each host tested? Interval:
     </td>
</tr>
<tr class="odd">
<td colspan="12"><p>12D. What host based Intrusion Detection Systems
(IDSs) are being used? LIST: </p>
<p>     </p></td>
</tr>
<tr class="even">
<td colspan="12"><p>12E. What network vulnerability assessment software
is being used? LIST:</p>
<p>     </p></td>
</tr>
<tr class="odd">
<td colspan="12">12F. Have the identified vulnerabilities been fixed?
</td>
</tr>
<tr class="even">
<td colspan="12">12G. How frequently is each network tested? Interval:
     </td>
</tr>
<tr class="odd">
<td colspan="12"><p>12H. What network based IDSs are being used?
LIST:</p>
<p>     </p></td>
</tr>
<tr class="even">
<td colspan="12">13. Physical Security</td>
</tr>
<tr class="odd">
<td colspan="12"><p>13A. What physical security barriers are in place
(e.g., office doors are locked when not occupied or after normal work
hours)? Explain:</p>
<p>     </p></td>
</tr>
<tr class="even">
<td colspan="12">13B. Do you train employees to challenge unknown
personnel encountered in the work area? </td>
</tr>
<tr class="odd">
<td colspan="12">13C. Is physical access to network components limited
to authorized personnel only? </td>
</tr>
<tr class="even">
<td colspan="12">14. Network Security/Remote Access/Control</td>
</tr>
<tr class="odd">
<td colspan="12">14A. Is remote access allowed? </td>
</tr>
<tr class="even">
<td colspan="12">14B. Are call back modems used? </td>
</tr>
<tr class="odd">
<td colspan="12">14C. Number of remote users?     </td>
</tr>
<tr class="even">
<td colspan="12">14D. Who authorizes this remote access? Title:
     </td>
</tr>
<tr class="odd">
<td colspan="12">14E. Are one-time passwords used? </td>
</tr>
<tr class="even">
<td colspan="12">14F. Are silent modems used? </td>
</tr>
<tr class="odd">
<td colspan="12">15. NISN Connectivity</td>
</tr>
<tr class="even">
<td colspan="12">15A. Is the IT resource connected to the PIP also
connected to any other network(s)? </td>
</tr>
<tr class="odd">
<td colspan="12">15B. Is the IT resource connected to the SIP also
connected to any other network(s)? </td>
</tr>
<tr class="even">
<td colspan="12">15C. Are connections between the PIP and other networks
made via routers? </td>
</tr>
<tr class="odd">
<td colspan="12">15D. Are connections between the SIP and other networks
made via routers? </td>
</tr>
<tr class="even">
<td colspan="12"><p>15E. Do any of the computers on your network have
more than one (1) network interface card (NIC)? </p>
<p>If yes, please identify the network(s) the computer is connected to
and explain its function.</p>
<p>     </p></td>
</tr>
<tr class="odd">
<td colspan="12"><p>15F. Does the project use wireless technology? </p>
<p>If yes, explain security measures:      </p></td>
</tr>
<tr class="even">
<td colspan="12"><p>15G. Does your project run its own Domain Name
Service (DNS)? </p>
<p>If yes, is it resolving NASA address space:      </p></td>
</tr>
<tr class="odd">
<td colspan="12">15H. Does your project make use of Virtual Local Area
Network (VLAN) technology? </td>
</tr>
<tr class="even">
<td colspan="12">Note: Requests for VLAN technology usage on the PIP/SIP
Networks are evaluated on a case-by-case basis.</td>
</tr>
<tr class="odd">
<td colspan="12">15I. Is Network Information System (NIS) technology
used or proposed for your networking environment? </td>
</tr>
<tr class="even">
<td colspan="12">15J. Is Dynamic Host Configuration Protocol (DHCP)
addressing used in your networking environment? </td>
</tr>
<tr class="odd">
<td colspan="12"><p>15K. Is your project implementing Network Address
Translation technology (NAT)? </p>
<p>If yes, is there a one-to-one mapping of IP addresses? </p></td>
</tr>
<tr class="even">
<td colspan="12">16. Firewalls</td>
</tr>
<tr class="odd">
<td colspan="12"><p>16A. Are local firewalls used? </p>
<p>If answer is No, go to 18 – Sensitive Information.</p></td>
</tr>
<tr class="even">
<td colspan="12">16B. Is the firewall on a dedicated computer? </td>
</tr>
<tr class="odd">
<td colspan="12">16C. Are deny-based rules used for connections
originating outside the firewall to systems inside the firewall? </td>
</tr>
<tr class="even">
<td colspan="12">16D. Are allow-based rules used for connections
originating inside the firewall to systems outside the firewall? </td>
</tr>
<tr class="odd">
<td colspan="12">16E. Are remote logins to the firewall allowed? </td>
</tr>
<tr class="even">
<td colspan="12">16F. Are security audits run on the firewall host
periodically? </td>
</tr>
<tr class="odd">
<td colspan="12">16G. Are all unnecessary firewall ports as well as
services disabled? </td>
</tr>
<tr class="even">
<td colspan="12">17. Sensitive Information:</td>
</tr>
<tr class="odd">
<td colspan="12">17A. Are any of the following items handled as
sensitive or Sensitive But Unclassified (SBU)? </td>
</tr>
<tr class="even">
<td colspan="2">IP Addresses:      </td>
<td colspan="7">Router restrictions:      </td>
<td colspan="3">Firewall rules:      </td>
</tr>
<tr class="odd">
<td colspan="4">Risk Assessments:      </td>
<td colspan="6">Vulnerabilities:      </td>
<td colspan="2">Passwords:      </td>
</tr>
</tbody>
</table>

  ----------------------------------------------------------------------------------
  **User ID and                                                            
  Password Management**                                                    
  --------------------- -------------- --------- ------------- ----------- ---------
  Questions:            Workstations   Servers   Routers       Firewalls   Other
                                                 and/or                    (i.e.,
                                                 Intelligent               Desktop
                                                 Switches                  Video)

  Number of machines                                                            
  connected?                                                               

  Number of systems                                                             
  that do NOT require a                                                    
  login name and                                                           
  password?                                                                

  Is there a management                                                         
  control process to                                                       
  ensure that all                                                          
  requests for user Ids                                                    
  are reviewed and                                                         
  approved by line                                                         
  management?                                                              

  Are all user IDs                                                              
  revalidated at least                                                     
  annually?                                                                

  Are passwords                                                                 
  required for all                                                         
  accounts?                                                                

  Are group/shared                                                              
  passwords allowed?                                                       

  Is password unique                                                            
  for each operator?                                                       

  Is password unique                                                            
  for each device?                                                         

  Is password length a                                                          
  minimum of eight                                                         
  characters?                                                              

  Does password                                                                 
  composition include                                                      
  three of the                                                             
  following four                                                           
  categories: upper                                                        
  case letters, lower                                                      
  case letters, special                                                    
  characters, and                                                          
  numbers?                                                                 

  Is an account                                                                 
  disabled after a set                                                     
  number of failed                                                         
  logins?                                                                  

  If yes, what is the                                                           
  number?                                                                  

  Does the system                                                               
  logoff or pause                                                          
  workstations/                                                            
  terminals                                                                
  automatically after                                                      
  30 minutes of                                                            
  keyboard and/or mouse                                                    
  inactivity?                                                              

  Do all super users                                                            
  and system                                                               
  administrators have a                                                    
  regular login                                                            
  account?                                                                 
  (non-privileged)                                                         

  Comments                                                                      

  NOTE: In all cases                                                       
  these answers are for                                                    
  equipment under your                                                     
  organization's                                                           
  control. Do not                                                          
  attempt to answer for                                                    
  equipment that is                                                        
  controlled by another                                                    
  project or group such                                                    
  as NISN, EOSDIS                                                          
  Backbone Network                                                         
  (EBnet), IONet, etc.                                                     
  ----------------------------------------------------------------------------------

  ----------------------------------------------------------------------------------------------
  **Software**                                                                          
  ------------------------ -------------- --------- ------------- ----------- --------- --------
  Questions:               Workstations   Servers   Route and/or  Firewalls   Other     
                                                    Intelligent               (i.e.,    
                                                    Switches                  Desktop   
                                                                              Video)    

  Is public domain                                                                      
  software used?                                                                        

  Are Operating System                                                                  
  (OS) and security                                                                     
  patches kept up to date?                                                              

  Are only specifically                                                                 
  needed server processes                                                               
  enabled?                                                                              

  Is exporting of whole                                                                 
  file systems allowed?                                                                 

  If yes, please describe                                                               
  the implementation and                                                                
  security controls.                                                                    

  Can root be exported?                                                                      

  If yes, please describe                                                               
  the implementation and                                                                
  security controls.                                                                    

  Comments                                                                              

  NOTE: In all cases these                                                              
  answers are for                                                                       
  equipment under your                                                                  
  organization's control.                                                               
  Do not attempt to answer                                                              
  for equipment that is                                                                 
  controlled by another                                                                 
  project or group such as                                                              
  NISN, EBnet, IONet, etc.                                                              
  ----------------------------------------------------------------------------------------------

  ------------------------------------------------------------------------------------
  **Audit Trail**                                                           
  -------------------------- -------------- --------- --------- ----------- ----------
  Questions:                 Workstations   Servers   Routers   Firewalls   Other
                                                                            (i.e.,
                                                                            Desktop
                                                                            Video)

  Is access failures to                                                          
  system, files, objects,                                                   
  and resources logged?                                                     

  Is all system privilege                                                        
  use logged?                                                               

  Is access to audit logs                                                        
  limited to authorized                                                     
  personnel only?                                                           

  Are audit logs reviewed at                                                     
  least weekly?                                                             

  Are audit logs kept for at                                                     
  least one year?                                                           

  Comments                                                                       

  NOTE: In all cases these                                                  
  answers are for equipment                                                 
  under your organization's                                                 
  control. Do not attempt to                                                
  answer for equipment that                                                 
  is controlled by another                                                  
  project or group such as                                                  
  NISN, EBnet, IONet, etc.                                                  
  ------------------------------------------------------------------------------------

I certify that the statements made on this form and all attached
statements are true, complete and correct to the best of my knowledge.

This document must be signed by the responsible manager for this
facility/project.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_­­­­­\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Name Title Date

References:

NPD 2810 "Security of Information Technology"

NPR 2810 "NASA Information Technology Operations Requirements"

NSD NISN-001-001 "NISN Services Document"
<http://nisn.nasa.gov/DocumentPages/Services.html>

Title III of the E-Government Act of 2002, the Federal Information
Security Management Act (FISMA)

NIST 800-53 "Security Controls for Federal Information Systems"