NNH16CP02Z

2

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION (NASA)

HEADQUARTERS (HQ) 

BUSINESS AND ADMINISTRATIVE SYSTEMS OFFICE (BASO)

BLANKET PURCHASE AGREEMENT (BPA)

Pursuant to General Services Administration (GSA) Professional Services Schedule (PSS), 

Consolidated GSA Schedule contract number GS-00F-0028Y, the Contractor agrees to the 

following terms of a Blanket Purchase Agreement (BPA) exclusively with NASA HQ:

1. TYPE OF TASK ORDERS

All orders placed against this BPA will be on a firm fixed price (FFP) basis, and will be within 

the scope of the Statement of Work, Attachment A. 

(End of text)

2. PRICING OF TASK ORDERS

Pricing of task orders placed under this BPA shall be based on the discounted GSA FSS contract 

pricing identified in the Direct Loaded Labor Rate Matrix, Attachment B, of this BPA. 

Subcontracts, travel, direct materials, and/or other direct costs shall be proposed on individual 

task orders, if applicable. 

(End of text)

3. ORDER OF PRECEDENCE

All orders placed against this BPA are subject to the terms and conditions of the GSA FSS 

contract and the NASA Federal Acquisition Regulation (FAR) Supplement (NFS) and HQ/GSFC 

clauses included herein. In the event of any inconsistency between the terms and conditions of 

this BPA and a Task Order issued against it, the terms and conditions of this BPA shall take 

precedence. The NASA HQ Contracting Officer (CO) shall be contacted in the event there are 

any issues/disagreements regarding the terms and conditions of this BPA.

(End of text)

4. SUBSTITUTION OF TERMS

This BPA contains clauses taken from, among other sources, the FAR, NFS, NASA HQ, and 

NASA GSFC. Whenever the word "contract" appears in FAR, NFS, HQ, or GSFC clauses 

presented herein, substitute the word "BPA" respectively. In addition, throughout this entire 

document, the term "Contracting Officer" refers to the NASA HQ Contracting Officer, Code 

210.H, except where specifically defined otherwise.

(End of text)
NNH16CP02Z

3

5. GSFC 52.211-90 SUPPLIES AND/OR SERVICES TO BE PROVIDED (NOV 2015)

Delivery destinations and schedules will be indicated on individual task orders placed against 

this BPA. In addition, the Contractor shall furnish the following items and reports:

Item Deliverable Reference Schedule Delivery 

Method/Addressee(s)

1

Services and 

deliverables in 

accordance with 

Attachment A, SOW

As Defined in 

Attachment A, 

SOW

As Defined in 

Attachment 

A, SOW

As Defined in 

Attachment A, SOW

2 Task Plans

Clause 12

NFS 1852.216-80

Clause 13

GSFC 52.216-93

As Specified 

in Clause 12

Electronic 

Format/Contracting 

Officer (CO)

2 Reports of Work Clause 22

GSFC 52.235-90

Monthly and 

Final As specified in Clause

3

Personal Identity

Verification (PIV) 

Documentation and 

Reporting 

Clause 28

HQ 52.204-98

and Attachment C

10th Calendar 

Day of the 

Month and 

As Required

Electronic Format/

Contracting Officer’s 

Representative (COR) 

& HQ Security Office 

4

Organizational 

Conflicts of Interest 

(OCI) Avoidance Plan

Clause 25

GSFC 1852.237-72

30 days after 

BPA effective 

date

Electronic 

Format/Contracting 

Officer (CO)

5

IT Security 

Management Plan

Clause 26

NFS 1852.204-76

30 days after 

BPA effective 

date

Electronic 

Format/Contracting 

Officer (CO)

6

Safety and Health 

Reporting

Clause 21

NFS 1852.223-70

Clause 24

HQ 52.223-91

Monthly and 

Quarterly and 

as required

NASA Mishap 

Information System 

(NMIS)

(End of text)

6. OBLIGATION OF FUNDS

This BPA does not obligate any funds. Funding will be provided on each individual task order. 

(End of text)

7. BPA ORDERING VALUE

The Government estimates, but does not guarantee, that the volume of orders through this BPA 

will be $19 million. This BPA does not obligate any funds. The Government is obligated only 
NNH16CP02Z

4

to the extent of authorized orders actually made against the BPA. 

(End of text)

8. ORDERING PERIOD

The BPA ordering period expires twelve (12) months from the effective date of the BPA or at the 

end of the GSA Schedule contract period, whichever is earlier. Each task order issued under this 

BPA shall specify its own period of performance not to exceed 12 months beyond the BPA 

ordering period. 

(End of text)

9. 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor 

within any day before contract expiration; provided that the Government gives the Contractor 

a preliminary written notice of its intent to extend at least 30 days before the contract expires. 

The preliminary notice does not commit the Government to an extension. 

(b) If the Government exercises this option, the extended contract shall be considered to include 

this option clause. 

(c) The total duration of this contract, including the exercise of any options under this clause, 

shall not exceed 60 months. 

(End of clause)

10. GSFC 52.217-90 OPTION TO EXTEND (SEP 2013)

In accordance with FAR clause 52.217-9, "Option to Extend the Term of the Contract" of this 

BPA, the Contracting Officer may exercise the following option(s) by issuance of a unilateral 

BPA modification. Options exercised shall be in accordance with the following:

Option 

Period Ordering Period

1 Twelve (12) months commencing at the end of the Basic Period

2 Twelve (12) months commencing at the end of Option Period 1

3 Twelve (12) months commencing at the end of Option Period 2

4 Twelve (12) months commencing at the end of Option Period 3

(End of clause)

11. GSFC 52.216-100 INDIVIDUALS AUTHORIZED TO ISSUE CALLS (DEC 2014)

The following personnel are authorized to issue calls under this BPA. All designated personnel 

are employed by the Headquarters unless otherwise indicated:
NNH16CP02Z

5

Contracting Officer, Code 210.H

(End of clause)

12. 1852.216-80 TASK ORDERING PROCEDURE (OCT 1996) 

(a) Only the CO may issue task orders to the Contractor, providing specific authorization or 

direction to perform work within the scope of the contract and as specified in the schedule. 

The Contractor may incur costs under this contract in performance of task orders and task 

order modifications issued in accordance with this clause. No other costs are authorized 

unless otherwise specified in the contract or expressly authorized by the CO.

(b) Prior to issuing a task order, the CO shall provide the Contractor with the following data: 

(1) A functional description of the work identifying the objectives or results desired from 

the contemplated task order. 

(2) Proposed performance standards to be used as criteria for determining whether the 

work requirements have been met. 

(3) A request for a task plan from the Contractor to include the technical approach, 

period of performance, appropriate cost information, and any other information 

required to determine the reasonableness of the Contractor's proposal.

(c) Within 7 calendar days after receipt of the CO's request, the Contractor shall submit a task 

plan conforming to the request. 

(d) After review and any necessary discussions, the CO may issue a task order to the Contractor 

containing, as a minimum, the following: 

(1) Date of the order.

(2) Contract number and order number.

(3) Functional description of the work identifying the objectives or results desired 

from the task order, including special instructions or other information necessary 

for performance of the task.

(4) Performance standards, and where appropriate, quality assurance standards.

(5) Maximum dollar amount authorized (cost and fee or price). This includes 

allocation of award fee among award fee periods, if applicable.

(6) Any other resources (travel, materials, equipment, facilities, etc.) authorized.

(7) Delivery/performance schedule including start and end dates.

(8) If contract funding is by individual task order, accounting and appropriation data. 

(e) The Contractor shall provide acknowledgment of receipt to the CO within 4 calendar days 

after receipt of the task order. 

(f) If time constraints do not permit issuance of a fully defined task order in accordance with the 
NNH16CP02Z

6

procedures described in paragraphs (a) through (d), a task order which includes a ceiling 

price may be issued.

(g) The CO may amend tasks in the same manner in which they were issued. 

(h) In the event of a conflict between the requirements of the task order and the Contractor's 

approved task plan, the task order shall prevail.

(End of clause)

13. GSFC 52.216-93 SUPPLEMENTAL TASK ORDERING PROCEDURES (FIXED 

PRICE) (JUL 2006)

(a) When the Government issues a request for a “task plan” to the Contractor in accordance with 

the Clause entitled “Task Ordering Procedure” of this contract, the Contractor shall prepare its 

estimate of the direct labor hours, direct labor categories, and other direct costs (ODCs) required 

to perform the task order requirements. The Contractor shall use only those appropriate direct 

labor categories, direct loaded labor rates, which may be less than but shall not exceed the rates 

found in Attachment B, Direct Labor Rate Matrix, to calculate the proposed firm fixed price 

(FFP) for all task orders issued in accordance with the “Task Ordering Procedure” clause of this 

contract. 

(b) The Contractor’s proposed approach/pricing of the representative tasks set forth in its 

quotation for award of this contract shall be used as reference by the Contracting Officer in 

negotiating tasks with the Contractor which are issued under this contract, but only to the extent 

portions of a representative task are relevant to portions of a task actually issued.

(End of clause)

14. GSFC 52.211-91 SCOPE OF WORK (MAR 2015)

The Contractor shall provide the personnel, materials, and facilities, except as otherwise 

specified in this BPA, necessary to perform the work and to furnish the items specified in 

SUPPLIES AND/OR SERVICES TO BE PROVIDED clause of this BPA in accordance with 

Attachment A, Statement of Work, and task orders issued hereunder.

(End of clause)

15. GSFC 52.237-92 PLACE OF PERFORMANCE – SERVICES (NOV 2013)

The services ordered under this BPA shall be performed at the following location(s): onsite at 

NASA Headquarters and other locations as specified in individual task orders issued.

 (End of clause)

16. INSPECTION AND ACCEPTANCE
NNH16CP02Z

7

Inspection and acceptance shall be accomplished in accordance with the terms of the

Professional Services Schedule (PSS), Consolidated GSA Schedule contract number GS-00F0028Y, BPA Agreement Number NNH16CP02Z and as outlined in the specific task order.

(End of text)

17. INVOICES

The contractor shall submit invoices for each individual task order as follows: 

(a) For Fixed Price Task Orders:

In addition to the requirements of GSFC 52.232-95, INVOICES—SUBMISSION OF, the 

invoice must include the name and address of the Contractor, Invoice Date, Task Order 

Number, description of the services/supplies, and the total Firm Fixed Price of the task order.

(End of text)

18. 1852.215-84 OMBUDSMAN (NOV 2011) – ALTERNATE I (JUN 2000)

(a) An ombudsman has been appointed to hear and facilitate the resolution of concerns from 

offerors, potential offerors, and contractors during the preaward and postaward phases of this 

acquisition. When requested, the ombudsman will maintain strict confidentiality as to the source 

of the concern. The existence of the ombudsman is not to diminish the authority of the 

contracting officer, the Source Evaluation Board, or the selection official. Further, the 

ombudsman does not participate in the evaluation of proposals, the source selection process, or 

the adjudication of formal contract disputes. Therefore, before consulting with an ombudsman, 

interested parties must first address their concerns, issues, disagreements, and/or 

recommendations to the contracting officer for resolution. 

(b) If resolution cannot be made by the contracting officer, interested parties may contact the 

installation ombudsman, whose name, address, telephone number, facsimile number, and e-mail 

address may be found at: http://prod.nais.nasa.gov/pub/pub_library/Omb.html. Concerns, issues, 

disagreements, and recommendations which cannot be resolved at the installation may be 

referred to the Agency ombudsman identified at the above URL. Please do not contact the 

ombudsman to request copies of the solicitation, verify offer due date, or clarify technical 

requirements. Such inquiries shall be directed to the Contracting Officer or as specified 

elsewhere in this document.

(c) If this is a task or delivery order contract, the ombudsman shall review complaints from 

contractors and ensure they are afforded a fair opportunity to be considered, consistent with the 

procedures of the contract. 

(End of clause)

19. 1852.237-73 RELEASE OF SENSITIVE INFORMATION (JUN 2005)
NNH16CP02Z

8

(a) As used in this clause, “sensitive information” refers to information, not currently in the 

public domain, that the Contractor has developed at private expense, that may embody trade 

secrets or commercial or financial information, and that may be sensitive or privileged.

(b) In accomplishing management activities and administrative functions, NASA relies heavily 

on the support of various service providers. To support NASA activities and functions, these 

service providers, as well as their subcontractors and their individual employees, may need 

access to sensitive information submitted by the Contractor under this contract. By submitting 

this proposal or performing this contract, the Contractor agrees that NASA may release to its 

service providers, their subcontractors, and their individual employees, sensitive information 

submitted during the course of this procurement, subject to the enumerated protections mandated 

by the clause at 1852.237-72, Access to Sensitive Information.

(c)(1) The Contractor shall identify any sensitive information submitted in support of this 

proposal or in performing this contract. For purposes of identifying sensitive information, the 

Contractor may, in addition to any other notice or legend otherwise required, use a notice similar 

to the following:

Mark the title page with the following legend:

This proposal or document includes sensitive information that NASA shall not disclose outside 

the Agency and its service providers that support management activities and administrative 

functions. To gain access to this sensitive information, a service provider's contract must contain 

the clause at NFS 1852.237-72, Access to Sensitive Information. Consistent with this clause, the 

service provider shall not duplicate, use, or disclose the information in whole or in part for any 

purpose other than to perform the services specified in its contract. This restriction does not limit 

the Government's right to use this information if it is obtained from another source without 

restriction. The information subject to this restriction is contained in pages [insert page numbers 

or other identification of pages].

Mark each page of sensitive information the Contractor wishes to restrict with the following 

legend:

Use or disclosure of sensitive information contained on this page is subject to the restriction on 

the title page of this proposal or document.

(2) The Contracting Officer shall evaluate the facts supporting any claim that particular

information is “sensitive.” This evaluation shall consider the time and resources necessary to 

protect the information in accordance with the detailed safeguards mandated by the clause at 

1852.237-72, Access to Sensitive Information. However, unless the Contracting Officer decides, 

with the advice of Center counsel, that reasonable grounds exist to challenge the Contractor's 

claim that particular information is sensitive, NASA and its service providers and their 

employees shall comply with all of the safeguards contained in paragraph (d) of this clause.

(d) To receive access to sensitive information needed to assist NASA in accomplishing 

management activities and administrative functions, the service provider must be operating under 
NNH16CP02Z

9

a contract that contains the clause at 1852.237-72, Access to Sensitive Information. This clause 

obligates the service provider to do the following:

(1) Comply with all specified procedures and obligations, including the Organizational Conflicts 

of Interest Avoidance Plan, which the contract has incorporated as a compliance document.

(2) Utilize any sensitive information coming into its possession only for the purpose of 

performing the services specified in its contract.

(3) Safeguard sensitive information coming into its possession from unauthorized use and 

disclosure.

(4) Allow access to sensitive information only to those employees that need it to perform 

services under its contract.

(5) Preclude access and disclosure of sensitive information to persons and entities outside of the 

service provider's organization.

(6) Train employees who may require access to sensitive information about their obligations to 

utilize it only to perform the services specified in its contract and to safeguard it from 

unauthorized use and disclosure.

(7) Obtain a written affirmation from each employee that he/she has received and will comply 

with training on the authorized uses and mandatory protections of sensitive information needed 

in performing this contract.

(8) Administer a monitoring process to ensure that employees comply with all reasonable 

security procedures, report any breaches to the Contracting Officer, and implement any 

necessary corrective actions.

(e) When the service provider will have primary responsibility for operating an information

technology system for NASA that contains sensitive information, the service provider's contract 

shall include the clause at 1852.204-76, Security Requirements for Unclassified Information 

Technology Resources. The Security Requirements clause requires the service provider to 

implement an Information Technology Security Plan to protect information processed, stored, or 

transmitted from unauthorized access, alteration, disclosure, or use. Service provider personnel 

requiring privileged access or limited privileged access to these information technology systems 

are subject to screening using the standard National Agency Check (NAC) forms appropriate to 

the level of risk for adverse impact to NASA missions. The Contracting Officer may allow the 

service provider to conduct its own screening, provided the service provider employs 

substantially equivalent screening procedures.

(f) This clause does not affect NASA's responsibilities under the Freedom of Information Act.
NNH16CP02Z

10

(g) The Contractor shall insert this clause, including this paragraph (g), suitably modified to 

reflect the relationship of the parties, in all subcontracts that may require the furnishing of 

sensitive information.

(End of clause)

20. HQ 52.247-94 SHIPPING INSTRUCTIONS--CENTRAL RECEIVING (SEP 2012)

Shipments of the items required under this BPA shall be to:

Receiving Officer

NASA/Headquarters

300 E. Street SW

Washington, D.C. 20546

Marked for: Kathryn Karmazin

Technical Officer: Kathryn Karmazin

NASA HQ, Room: 4O32

BPA No. NNH15CN62Z

Order No. TBD

Item(s) No. TBD

(End of clause)

21. 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if 

they were given in full text. Upon request, the Contracting Officer will make their full text 

available. Also, the full text of a clause may be accessed electronically at these addresses:

Federal Acquisition Regulation (FAR) clauses: 

https://www.acquisition.gov/?q=browsefar

NASA FAR Supplement (NFS) clauses: 

http://www.hq.nasa.gov/office/procurement/regs/nfstoc.htm 

In addition to the GSA FSS contract schedule clauses, this BPA is subject to the following 

clauses:

FAR CLAUSES:

52.245-9 USE AND CHARGES (APR 2012)

1852.203-71 REQUIREMENT TO INFORM EMPLOYEES OF WHISTLEBLOWER 

RIGHTS (AUG 2014)

1852.223-70 SAFETY AND HEALTH (APR 2002)

1852.223-75 MAJOR BREACH OF SAFETY OR SECURITY (FEB 2002) –ALTERNATE I 

(FEB 2006)

NASA FAR SUPPLEMENT CLAUSES:

1852.203-71 REQUIREMENT TO INFORM EMPLOYEES OF WHISTLEBLOWER RIGHTS (AUG 2014)
NNH16CP02Z

11

1852.225-70 EXPORT LICENSES (FEB 2000)

1852.228-75 MINIMUM INSURANCE COVERAGE (OCT 1988)

1852.245-75 PROPERTY MANAGEMENT (JAN 2011)

1852.245-78 PHYSICAL INVENTORY OF CAPITAL PERSONAL PROPERTY (AUG 

2015)

1852.245-82 OCCUPANCY MANAGEMENT REQUIREMENTS (JAN 2011)

(End of by reference section)

22. GSFC 52.235-90 REPORTS OF WORK (IDIQ/BPA) (AUG 2013)

(a) Monthly progress reports. The Contractor shall submit monthly progress reports of all work 

accomplished covering all Task Orders active during each month of BPA performance. 

Reports shall address the accomplishments and progress of all work performed under each 

Task Order for the month being reported. Each Task Order shall be a separate report. The 

report shall be in narrative form and brief in content. The report shall include a description 

of overall Task Order progress to include technical accomplishments and status of 

deliverables. Also the report shall provide a quantitative description of overall progress and 

identify any risks or problems, which may impede performance and proposed corrective 

actions. Also the report shall have a discussion of the projected work activities to be 

performed during the next monthly reporting period.

(b) Final Task Order Report. The Contractor shall submit a Final Task Order Report for each 

completed Task Order that summarizes the results of the entire Task Order, including recommendations and conclusions based on the experience and results obtained. The Final Task 

Order Report should include, as appropriate, tables, graphs, diagrams, curves, sketches, photographs, and drawings in sufficient detail to comprehensively explain the results achieved under 

the Task Order. The final report shall also include the final fixed price for the Task Order.

(c) Submission. The Contractor shall submit the report required by this clause as follows:

Copies Report Type Addressee Mail Code

1 M,F Contracting Officer GSFC:210.H

1 M,F Contracting Officer's Representative (COR) HQ:2J81

1 M,F Task Monitor See Task Order

 [M=Monthly, F=Final]

(d) Submission dates. Monthly reports shall be submitted by the 15th day of the month 

following the month being reported. If the Task Order is awarded beyond the middle of a 

month, the first monthly report shall cover the period from award until the end of the 

following month. The final report for each Task Order shall be submitted within 30 days after 

completion of the Task Order.

(End of clause)
NNH16CP02Z

12

23. GSFC 52.232-95 INVOICES - SUBMISSION OF (MAR 2015)

Invoices shall be prepared in accordance with the Prompt Payment clause of this contract and 

submitted to the NASA Shared Services Center (NSSC), Financial Management Division (FMD) 

– Accounts Payable, Bldg. 1111, C. Road, Stennis Space Center, MS 39529; Email: NSSCAccountsPayable@nasa.gov. For purposes of the Prompt Payment Act, the above office is 

considered to be the "Designated Billing Office" and the "Designated Payment Office."

(End of clause)

24. HQ 52.223-91 SAFETY AND HEALTH--ADDITIONAL REQUIREMENTS (JUN 

2014)

In addition to compliance with all Federal, state, and local laws as required by paragraph (b) of 

NFS clause 1852.223-70, the Contractor shall comply with the following:

(a) Incident Reporting: The immediate notification and prompt reporting requirement included 

in paragraph (d) of NFS clause 1852.223-70 shall be to the NASA Headquarters Safety and 

Occupational Health, Dept. HQ:LM032, Telephone 202-358-0854 and to the Contracting Officer 

(CO). This verbal notification should be confirmed in writing via E-Mail to the CO and 

christopher.j.warren@nasa.gov and entered into the NASA Mishap Information System (NMIS) 

within 24 hours. This notification is also required for any unsafe or environmentally hazardous 

condition associated with Government-owned property that is provided or made available for the 

performance of the contract.

(b) Submit a monthly safety and health report using NMIS. Specify incidents (mishaps and close 

calls) and man-hours worked/month. Access to NMIS must be requested through the NASA 

Access Management System (NAMS) within 30 days of the contract effective date at 

https://idmax.nasa.gov. Until access is approved, use the Monthly Safety & Health Report 

Template available at http://safety1st.gsfc.nasa.gov under Contractor Safety and e-mail the 

completed form to christopher.j.warren@nasa.gov.

(End of clause)

25. 1852.237-72 ACCESS TO SENSITIVE INFORMATION (JUN 2005) 

(a) As used in this clause, “sensitive information” refers to information that a contractor has 

developed at private expense, or that the Government has generated that qualifies for an 

exception to the Freedom of Information Act, which is not currently in the public domain, and 

which may embody trade secrets or commercial or financial information, and which may be 

sensitive or privileged.

(b) To assist NASA in accomplishing management activities and administrative functions, the 

Contractor shall provide the services specified elsewhere in this contract.

(c) If performing this contract entails access to sensitive information, as defined above, the 

Contractor agrees to—
NNH16CP02Z

13

(1) Utilize any sensitive information coming into its possession only for the purposes of 

performing the services specified in this contract, and not to improve its own competitive 

position in another procurement.

(2) Safeguard sensitive information coming into its possession from unauthorized use and 

disclosure.

(3) Allow access to sensitive information only to those employees that need it to perform 

services under this contract.

(4) Preclude access and disclosure of sensitive information to persons and entities outside of the 

Contractor's organization.

(5) Train employees who may require access to sensitive information about their obligations to 

utilize it only to perform the services specified in this contract and to safeguard it from 

unauthorized use and disclosure.

(6) Obtain a written affirmation from each employee that he/she has received and will comply 

with training on the authorized uses and mandatory protections of sensitive information needed 

in performing this contract.

(7) Administer a monitoring process to ensure that employees comply with all reasonable 

security procedures, report any breaches to the Contracting Officer, and implement any 

necessary corrective actions.

(d) The Contractor will comply with all procedures and obligations specified in its 

Organizational Conflicts of Interest Avoidance Plan, which this contract incorporates as a 

compliance document.

(e) The nature of the work on this contract may subject the Contractor and its employees to a 

variety of laws and regulations relating to ethics, conflicts of interest, corruption, and other 

criminal or civil matters relating to the award and administration of government contracts. 

Recognizing that this contract establishes a high standard of accountability and trust, the 

Government will carefully review the Contractor's performance in relation to the mandates and 

restrictions found in these laws and regulations. Unauthorized uses or disclosures of sensitive 

information may result in termination of this contract for default, or in debarment of the 

Contractor for serious misconduct affecting present responsibility as a government contractor.

(f) The Contractor shall include the substance of this clause, including this paragraph (f), suitably 

modified to reflect the relationship of the parties, in all subcontracts that may involve access to 

sensitive information.

(End of clause)

26. 1852.204-76 SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION 

TECHNOLOGY RESOURCES (JAN 2011)
NNH16CP02Z

14

(a) The contractor shall protect the confidentiality, integrity, and availability of NASA 

Electronic Information and IT resources and protect NASA Electronic Information from 

unauthorized disclosure.

(b) This clause is applicable to all NASA contractors and sub-contractors that process, manage, 

access, or store unclassified electronic information, to include Sensitive But Unclassified 

(SBU) information, for NASA in support of NASA’s missions, programs, projects and/or 

institutional requirements. Applicable requirements, regulations, policies, and guidelines are 

identified in the Applicable Documents List (ADL) provided as an attachment to the contract. 

The documents listed in the ADL can be found at: 

http://www.nasa.gov/offices/ocio/itsecurity/index.html . For policy information considered 

sensitive, the documents will be identified as such in the ADL and made available through 

the Contracting Officer.

(c) Definitions.

(1) IT resources means any hardware or software or interconnected system or subsystem of 

equipment, that is used to process, manage, access, or store electronic information.

(2) NASA Electronic Information is any data (as defined in the Rights in Data clause of this 

contract) or information (including information incidental to contract administration, such 

as financial, administrative, cost or pricing, or management information) that is 

processed, managed, accessed or stored on an IT system(s) in the performance of a 

NASA contract.

(3) IT Security Management Plan—This plan shall describe the processes and procedures 

that will be followed to ensure appropriate security of IT resources that are developed, 

processed, or used under this contract. Unlike the IT security plan, which addresses the 

IT system, the IT Security Management Plan addresses how the contractor will manage 

personnel and processes associated with IT Security on the instant contract.

(4) IT Security Plan—this is a FISMA requirement; see the ADL for applicable 

requirements. The IT Security Plan is specific to the IT System and not the contract. 

Within 30 days after award, the contractor shall develop and deliver an IT Security 

Management Plan to the Contracting Officer; the approval authority will be included in 

the ADL. All contractor personnel requiring physical or logical access to NASA IT 

resources must complete NASA’s annual IT Security Awareness training. Refer to the IT 

Training policy located in the IT Security Web site at 

https://itsecurity.nasa.gov/policies/index.html.

(d) The contractor shall afford Government access to the Contractor’s and subcontractors’ 

facilities, installations, operations, documentation, databases, and personnel used in 

performance of the contract. Access shall be provided to the extent required to carry out a 

program of IT inspection (to include vulnerability testing), investigation and audit to 

safeguard against threats and hazards to the integrity, availability, and confidentiality of 
NNH16CP02Z

15

NASA Electronic Information or to the function of IT systems operated on behalf of NASA, 

and to preserve evidence of computer crime.

(e) At the completion of the contract, the contractor shall return all NASA information and IT 

resources provided to the contractor during the performance of the contract in accordance 

with retention documentation available in the ADL. The contractor shall provide a listing of 

all NASA Electronic information and IT resources generated in performance of the contract. 

At that time, the contractor shall request disposition instructions from the Contracting 

Officer. The Contracting Officer will provide disposition instructions within 30 calendar 

days of the contractor’s request. Parts of the clause and referenced ADL may be waived by 

the contracting officer, if the contractor’s ongoing IT security program meets or exceeds the 

requirements of NASA Procedural Requirements (NPR) 2810.1 in effect at time of award. 

The current version of NPR 2810.1 is referenced in the ADL. The contractor shall submit a 

written waiver request to the Contracting Officer within 30 days of award. The waiver 

request will be reviewed by the Center IT Security Manager. If approved, the Contractor 

Officer will notify the contractor, by contract modification, which parts of the clause or 

provisions of the ADL are waived.

(f) The contractor shall insert this clause, including this paragraph in all subcontracts that 

process, manage, access or store NASA Electronic Information in support of the mission of 

the Agency. 

(End of clause)

27. 1852.232-77 LIMITATION OF FUNDS (FIXED-PRICE CONTRACT) (MAR 1989) 

 (a) Each FFP order may be incrementally funded. It is anticipated that from time to time 

additional funds will be allocated to a FFP order until the total price of the order is allotted. The 

parties contemplate that the Government will allot funds to an order in accordance with the 

following schedule:

SCHEDULE FOR ALLOTMENT OF FUNDS

 Date Amounts

 As executed by Order As determined by Order

(b) The Contractor agrees to perform or have performed work on issued orders up to the point at 

which, if this BPA is terminated pursuant to the Termination for the Government’s Convenience 

paragraph (l) of FAR 52.212-4 included in the GSA FSS Master Contract, the total amount 

payable by the Government (including amounts payable for subcontracts and settlement costs) 

pursuant to that provision would, in the exercise of reasonable judgment by the Contractor, 

approximate the total amount at the time allotted to the orders. The Contractor is not obligated to 

continue performance of the work beyond that point. The Government is not obligated in any 

event to pay or reimburse the Contractor more than the amount from time to time allotted to the

order, anything to the contrary in the Termination for the Government’s Convenience paragraph 

(1) of FAR 52.212-4 notwithstanding.
NNH16CP02Z

16

(c)(1) It is contemplated that funds presently allotted to an order will cover the work to be 

performed as determined by each order.

(2) If funds allotted are considered by the Contractor to be inadequate to cover the work to be 

performed as determined by each order, the Contractor shall notify the Contracting 

Officer in writing when within the next 60 days the work will reach a point at which, if 

the order is terminated pursuant to the Termination for the Government’s Convenience 

paragraph (l) of FAR 52.212-4 in the GSA FSS Master contract, the total amount payable 

by the Government (including amounts payable for subcontracts and settlement costs) 

pursuant to that provision will approximate 75 percent of the total amount then allotted to 

the order.

(3) (i) The notice shall state the estimated date when the point referred to in subparagraph 

(2) above will be reached and the estimated amount of additional funds required to 

continue performance to the date specified in subparagraph (1) above, or an agreed date 

substituted for it.

(ii) The Contractor shall, 60 days in advance of the date specified in subparagraph (1) 

above, or an agreed date substituted for it, advise the Contracting Officer in writing as to 

the estimated amount of additional funds required for the timely performance of the order 

for a further period as may be specified in the order or otherwise agreed to by the parties.

(4) If, after the notification referred to in subdivision (3)(ii) above, additional funds are not 

allotted by the date specified in subparagraph (1) above, or an agreed date substituted for 

it, the Contracting Officer shall, upon the Contractor's written request, terminate this 

order on that date or on the date set forth in the request, whichever is later, pursuant to the 

Termination for the Government’s Convenience paragraph (l) of FAR 52.212-4.

(d) When additional funds are allotted from time to time for continued performance of the work 

under an order, the parties shall agree on the applicable period of performance to be covered by 

these funds. The provisions of paragraphs (b) and (c) above shall apply to these additional 

allotted funds and substituted date pertaining to them, and the order shall be modified 

accordingly.

(e) If, solely by reason of the Government's failure to allot additional funds in amounts sufficient 

for the timely performance of an order, the Contractor incurs additional costs or is delayed in the 

performance of the work under an order, and if additional funds are allotted, an equitable 

adjustment shall be made in the price or prices (including appropriate target, billing, and ceiling 

prices where applicable) of the items to be delivered, or in the time of delivery or both.

(f) The Government may at any time before termination, and, with the consent of the Contractor, 

after notice of termination, allot additional funds for an order.

(g) The provisions of this clause with respect to termination shall in no way be deemed to limit 

the rights of the Government under the Termination for clause paragraph (m) of FAR 52.212-4 in 

the GSA FSS Master Contract. The provisions of this Limitation of Funds clause are limited to 
NNH16CP02Z

17

the work on and allotment of funds for the items set forth in paragraph (a) above. This clause 

shall become inoperative upon the allotment of funds for the total price of said work except for 

rights and obligations then existing under this clause.

(h) Nothing in this clause shall affect the right of the Government to terminate this BPA 

pursuant to the Termination for the Government’s Convenience paragraph (l) of FAR 52.212-4 

included in the GSA FSS Master Contract.

(End of clause)

28. HQ 52.204-98 ONSITE CONTRACTOR PERSONNEL - IDENTIFICATION, 

REPORTING, AND CHECKOUT PROCEDURES (APR 2013)

(a) The Contractor’s designated representative for the purposes of this clause is the Contractor’s 

Project Manager. The Contractor shall notify the Headquarters Chief of Security and the 

Contracting Officer’s Representative (COR) of the Project Manager’s identity within fifteen (15) 

calendar days of award of this Contract.

(b) In accordance with FAR 52.204-9, Personal Identity Verification of Contractor Personnel, 

the Contractor shall follow the steps in Attachment C, Personal Identity Verification (PIV) Card 

Issuance Procedures, for each Contract employee (prime and subcontractor) who shall have 

physical access to a NASA-controlled facility (also referred to as “onsite”) or access to a Federal 

information system. The Contractor must apply for permanent NASA Headquarters PIV 

credential for those Contract employees who will be employed by the Contractor onsite for at 

least six months. The Headquarters Security Office will consider permanent PIV credentials for 

other employees of the Contractor on a case-by-case basis, such as employees that are not 

resident onsite, but must frequently visit.

(c) The Contractor may contact the PIV Manager, Tel 202-358-2422 for assistance regarding the 

PIV system. Each contract employee shall provide to the Contractor’s designated PIV Requester 

the basic identifying information required for a PIV Request to be initiated in the PIV System. 

The NASA maintained PIV system contains work and home location and contact information for 

personnel that have permanent NASA PIV cards. The PIV Request must be approved by the 

PIV Sponsor (COR or the Contracting Officer). The COR will resolve any housing or access 

issues, and review the request for accuracy and completeness. Requests that are approved by the 

PIV Sponsor will be forwarded to the Headquarters Security Office for PIV Authorization, 

Badge enrollment, and Badge issuance.

 

(d) The Contractor shall submit an annotated PIV Report each month. The HQ PIV Manager 

will furnish a PIV print-out to the Contractor no later than the end of each month. The Contractor 

shall annotate this provided report monthly to correct and update the information as follows:

(1) Draw a line through the names of employees who are no longer employed by the 

contractor or that no longer work onsite under the contract, and;

(2) Make handwritten changes to any other incorrect data.

The annotated PIV Report shall be separately submitted to the Headquarters Security Office, 

Attention: PIV Manager, and to the COR by the 10th calendar day of the month. 
NNH16CP02Z

18

For the final PIV Report under the contract, the HQ PIV Manager will furnish a PIV print-out to 

the Contractor no later than two weeks prior to the end of the contract. The Contractor shall 

submit its annotated final PIV Report no later than 3 days prior to the end of the contract.

If this is a follow-on contract, at the end of the phase-in period (if any)/start of the basic contract 

period, the HQ Security Office will provide the Contractor a copy of the final PIV Report from 

the previous contract. The Contractor shall review the list and redline it as necessary to reflect its 

employees requiring PIV cards. The redlined list shall be provided the HQ Security Office 

within 30 days after the start of the contract.

(e) The Contractor’s Project Manager shall submit written notification to the Contracting 

Officer’s Representative and the Headquarters Chief of Security immediately about any 

Contractor employee who was issued a Headquarters PIV credential or who was granted 

temporary access to be on-site: (1) who is no longer employed by the Contractor, or (2) who will 

no longer be working onsite under this Contract.

(f) The Contractor shall ensure that all personnel who have NASA Headquarters issued 

credentials, keys or other property who leave the Contractor’s employ or that no longer work 

onsite, process out through the Headquarters Security Office. Any such Contractor employees 

must return all Headquarters issued identification or credentials and any Government property no 

later than the last day of their employment. The Contractor shall establish appropriate 

procedures and controls to ensure this is accomplished. Failure to comply may result in the 

exercise of Government rights to limit and control access to Government premises, including 

denial of access and invalidation of NASA issued PIV credentials.

(End of clause)

29. HQ 52.204-99 GOVERNMENT PREMISES – PHYSICAL ACCESS AND 

COMPLIANCE WITH PROCEDURES (APR 2013)

(a)(1) The Contractor must apply for NASA Headquarters Personal Identity Verification (PIV) 

credential issued by the Headquarters Security Office for those employees that will be employed 

by the Contractor and that will be resident or access NASA Headquarter locations, or NASA 

cyber resources for more than six (6) months. The Headquarters PIV credentials will be issued 

for no longer than the applicable Contract period in effect at the time, not to exceed 5-years, and 

will require renewal for each subsequent Contract period within which the Contractor employee 

will be employed. Based on NASA policies and procedures for background investigations and 

position risk/sensitivity determination, a minimum of National Agency Check with Written 

Inquiries (NACI) will be required for credential renewal. Other Contractor personnel who are to 

be at the Headquarters location(s) or will be accessing NASA cyber resources for less than six 

(6) months are to be identified by the Contractor for approval and registered on an access list 

under the control of the Headquarters Security Office. All personnel must conspicuously display 

the Headquarters PIV credential above the waistline on the outermost garment, and must comply 

with any and all requirements applicable to PIV credential in effect at Headquarters. In 

accordance with FAR 52.204-9, Personal Identity Verification of Contractor Personnel, the 

Contractor shall follow the steps prescribed in Attachment C, Personal Identity Verification 
NNH16CP02Z

19

(PIV) Card Issuance Procedures to apply for each Contract employee (prime and subcontractor) 

who shall have physical access to a NASA-controlled facility (also referred to as “onsite”) or 

access to a Federal information system. 

(2) Visits by foreign nationals to, for, or on behalf of the Contractor, are restricted and 

must be necessary for the performance of the Contract and concurred in by the Contracting 

Officer or by the Contracting Officer’s Representative. Approval of such visits must be 

approved in advance in accordance with NASA Policy Directive, NPD 1371.5, Coordination and 

Authorization of Access by Foreign Nationals and Foreign Representatives to NASA 

(Revalidated 12/21/2010). Copies of the current issuances of the NPD may be obtained at 

http://nodis3.gsfc.nasa.gov. The Contractor may get further information about visits by foreign 

nationals by contacting the NASA Headquarters International Visits Coordinator located in the 

Headquarters Security Office. 

(3) Access to the Headquarters locations may be changed or adjusted in response to 

threat conditions or special situations.

(b) While on Government premises, the Contractor shall comply with requirements governing 

the conduct of personnel and the operation of the Headquarters locations. These requirements 

are set forth in NASA-wide or Headquarters installation directives, and procedural requirements, 

and announcements that can be found at http://nodis3.gsfc.nasa.gov/, and/or which will be 

provided to the Contractor as necessary by the Contracting Officer’s Representative, the 

Contracting Officer, or the Headquarters Chief of Security.

(c) The Contractor may not use official Government envelopes or other Government identified 

mailing containers bearing any sort of Government indicia such as "eagle" emblems in lieu of 

postage stamps or mailing envelopes or containers bearing NASA logos. The Contractor also 

may not use the Government mail system to mail anything outside of the Headquarters locations. 

Contractors found in violation could be liable for a fine of $300 per piece of indicia mail used. 

Otherwise, the Contractor is allowed to use the internal Headquarters interoffice mail system to 

send documents within the Headquarters locations or to other NASA Centers or NASA 

facilities the extent necessary for purposes of implementing the terms of this Contract and 

communicating Contract related business to its employees at the Headquarters locations, and to 

communicate Contract related business to NASA officials including, but not limited to, the 

Contracting Officer, the Contracting Officer’s Representative, the Headquarters Chief of 

Security, Accounting Office staff, and the NASA Headquarters International Visits Coordinator.

(End of clause)

30. 1852.242-72 DENIED ACCESS TO NASA FACILITIES (OCT 2015)

(a)(1) The performance of this contract requires contractor employees of the prime contractor or 

any subcontractor, affiliate, partner, joint venture, or team member with which the contractor is 

associated, including consultants engaged by any of these entities, to have access to, physical 

entry into, and to the extent authorized, mobility within, a NASA facility.
NNH16CP02Z

20

 (2) NASA may close and or deny contractor access to a NASA facility for a portion of a 

business day or longer due to any one of the following events:

 (i) Federal public holidays for federal employees in accordance with 5 U.S.C. 6103.

 (ii) Fires, floods, earthquakes, unusually severe weather to include snow storms, 

tornadoes and hurricanes.

 (iii) Occupational safety or health hazards.

 (iv) Non-appropriation of funds by Congress.

 (v) Any other reason.

 (3) In such events, the contractor employees may be denied access to a NASA facility, in part 

or in whole, to perform work required by the contract. Contractor personnel already present at a 

NASA facility during such events may be required to leave the facility.

 (b) In all instances where contractor employees are denied access or required to vacate a 

NASA facility, in part or in whole, the contractor shall be responsible to ensure 

contractor personnel working under the contract comply. If the circumstances permit, the 

contracting officer will provide direction to the contractor, which could include continuing onsite performance during the NASA facility closure period. In the absence of such direction, the 

contractor shall exercise sound judgment to minimize unnecessary contract costs and 

performance impacts by, for example, performing required work off-site if possible or 

reassigning personnel to other activities if appropriate.

 (c) The contractor shall be responsible for monitoring the local radio, television stations, 

NASA Web sites, other communications channels, for example contracting officer notification, 

that the NASA facility is accessible. Once accessible the contractor shall resume contract 

performance as required by the contract.

 (d) For the period that NASA facilities were not accessible to contractor employees, the 

contracting officer may—

(1) Adjust the contract performance or delivery schedule for a period equivalent to the 

period the NASA facility was not accessible;

 (2) Forego the work;

 (3) Reschedule the work by mutual agreement of the parties; or

 (4) Consider properly documented requests for equitable adjustment, claim, or any other 

remedy pursuant to the terms and conditions of the contract.

 (e) Notification procedures of a NASA facility closure, including contractor denial of access, 

as follows:

 (1) The contractor shall be responsible for monitoring the local radio, television stations, 

NASA Web sites, other communications channels, for example contracting officer notification, 

for announcement of a NASA facility closure to include denial of access to the NASA 

facility. The contractor shall be responsible for notification of its employees of the NASA 

facility closure to include denial of access to the NASA facility. The dismissal of NASA 

employees in accordance with statute and regulations providing for such dismissals shall not, in 

itself, equate to a NASA facility closure in which contractor employees are denied 

access. Moreover, the leave status of NASA employees shall not be conveyed or imputed to 
NNH16CP02Z

21

contractor personnel. Accordingly, unless a NASA facility is closed and the contractor is denied 

access to the facility, the contractor shall continue performance in accordance with the contract.

 (2) NASA’s Emergency Notification System (ENS). ENS is a NASA-wide Emergency 

Notification and Accountability System that provides NASA the ability to send messages, both 

Agency-related and/or Center-related, in the event of an emergency or emerging situation at a 

NASA facility. Notification is provided via multiple communication devices, e.g. Email, text, 

cellular, home / office numbers. The ENS provides the capability to respond to notifications and 

provide the safety status. Contractor employees may register for these notifications at the ENS

Web site: http://www.hq.nasa.gov/office/ops/nasaonly/ENSinformation.html .

(End of clause)

31. 1852.245-71 INSTALLATION-ACCOUNTABLE GOVERNMENT PROPERTY (JAN 

2011)

(a) The Government property described in paragraph (c) of this clause may be made available to 

the Contractor on a no-charge basis for use in performance of this contract. This property shall 

be utilized only within the physical confines of the NASA installation that provided the property 

unless authorized by the Contracting Officer under (b)(1)(iv). Under this clause, the Government 

retains accountability for, and title to, the property, and the Contractor shall comply with the 

following:

(1) NASA Procedural Requirements (NPR) 4100.1, NASA Materials Inventory 

Management Manual;

(2) NASA Procedural Requirements (NPR) 4200.1, NASA Equipment Management 

Procedural Requirements;

(3) NASA Procedural Requirement (NPR) 4300.1, NASA Personal Property Disposal 

Procedural Requirements;

(4) Notify the cognizant property custodian, Contracting Officer’s Representative (COR), 

and the Installation Security Officer immediately if theft of Government property is 

suspected or property cannot be located 

(5) Identify Government property equipment that is no longer considered necessary for 

performance of the contract. 

(6) Ensure that equipment is turned in to the Property Disposal Officer through the 

cognizant property custodian when no longer needed. This is the only acceptable 

procedure for disposal of Government property.

(7) Do not relocate Government property within Government premises or remove 

Government property from Government premises without written approval.

(8) Ensure that Government property, including property leased to the Government, is 

used only for the purposes of performing the contract.

(9) Ensure that Government property is protected and conserved.

Property not recorded in NASA property systems must be managed in accordance with the 

requirements of the clause at FAR 52.245-1, as incorporated in this contract.
NNH16CP02Z

22

The Contractor shall establish and adhere to a system of written procedures to assure continued, 

effective management control and compliance with these user responsibilities. In accordance 

with FAR 52.245-1(h)(1) the contractor shall be liable for property lost, damaged, destroyed or 

stolen by the contractor or their employees when determined responsible by a NASA Property 

Survey Board, in accordance with the NASA guidance in this clause.

(b)(1) The official accountable recordkeeping, financial control, and reporting of the property 

subject to this clause shall be retained by the Government and accomplished within NASA 

management information systems prescribed by the installation Supply and Equipment 

Management Officer (SEMO) and Financial Management Officer. If this contract provides for 

the Contractor to acquire property, title to which will vest in the Government, the following 

additional procedures apply:

 (i) The Contractor's purchase order shall require the vendor to deliver the property to the 

installation central receiving area.

 (ii) The Contractor shall furnish a copy of each purchase order, prior to delivery by the vendor, 

to the installation central receiving area.

 (iii) The Contractor shall establish a record for Government titled property as required by FAR 

52.245-1, as incorporated in this contract, and shall maintain that record until accountability is 

accepted by the Government.

 (iv) Contractor use of Government property at an off-site location and off-site subcontractor 

use requires advance approval of the Contracting Officer and notification of the Industrial 

Property Officer. The property shall be considered Government furnished and the Contractor 

shall assume accountability and financial reporting responsibility. The Contractor shall establish 

records and property control procedures and maintain the property in accordance with the 

requirements of FAR 52.245-1, Government Property (as incorporated in this contract), until its 

return to the installation. NASA 

Procedural Requirements related to property loans shall not apply to offsite use of property by 

contractors.

 (2) After transfer of accountability to the Government, the Contractor shall continue to 

maintain such internal records as are necessary to execute the user responsibilities identified in 

paragraph (a) of this clause and document the acquisition, billing, and disposition of the 

property. These records and supporting documentation shall be made available, upon request, to 

the SEMO and any other authorized representatives of the Contracting Officer.

(c) The following property and services are provided if checked:

__X__ (1) Office space, work area space, and utilities. Government telephones are available for 

official purposes only.

__X__ (2) Office furniture.

____ (3) Property listed in Not Applicable.

(i) If the Contractor acquires property, title to which vests in the Government pursuant to 

other provisions of this contract, this property also shall become accountable to the 

Government upon its entry into Government records.

(ii) The Contractor shall not bring to the installation for use under this contract any 

property owned or leased by the Contractor, or other property that the Contractor is 

accountable for under any other Government contract, without the Contracting Officer's 

prior written approval.
NNH16CP02Z

23

__X__ (4) Supplies from stores stock.

__X__ (5) Publications and blank forms stocked by the installation.

__X__ (6) Safety and fire protection for Contractor personnel and facilities.

__X__ (7) Installation service facilities: “IT Services through the Agency Consolidated Enduser Services (ACES) contract”.

__X__ (8) Medical treatment of a first-aid nature for Contractor personnel injuries or illnesses 

sustained during on-site duty.

__X__ (9) Cafeteria privileges for Contractor employees during normal operating hours.

__X__ (10) Building maintenance for facilities occupied by Contractor personnel.

__X__ (11) Moving and hauling for office moves, movement of large equipment, and delivery of 

supplies. Moving services may be provided on-site, as approved by the Contracting Officer.

(End of clause)

32. 1852.245-74 IDENTIFICATION AND MARKING OF GOVERNMENT EQUIPMENT 

(JAN 2011)

(a) The Contractor shall identify all equipment to be delivered to the Government using NASA 

Technical Handbook (NASA-HDBK) 6003, Application of Data Matrix Identification Symbols 

to Aerospace Parts Using Direct Part Marking Methods/Techniques, and NASA Standard 

(NASA-STD) 6002, Applying Data Matrix Identification Symbols on Aerospace Parts or 

through the use of commercial marking techniques that: (1) are sufficiently durable to remain 

intact through the typical lifespan of the property: and, (2) contain the data and data format 

required by the standards. This requirement includes deliverable equipment listed in the schedule 

and other equipment when no longer required for contract performance and NASA directs 

physical transfer to NASA or a third party. The Contractor shall identify property in both 

machine and human readable form unless the use of a machine readable-only format is approved 

by the NASA Industrial Property Officer.

(b) Equipment shall be marked in a location that will be human readable, without disassembly or 

movement of the equipment, when the items are placed in service unless such placement would 

have a deleterious effect on safety or on the item's operation.

(c) Concurrent with equipment delivery or transfer, the Contractor shall provide the following 

data in an electronic spreadsheet format:

 (1) Item Description.

 (2) Unique Identification Number (License Tag).

 (3) Unit Price.

 (4) An explanation of the data used to make the unique identification number.

(d) For equipment no longer needed for contract performance and physically transferred under 

paragraph (a) of this clause, the following additional data is required:

 (1) Date originally placed in service.

 (2) Item condition.
NNH16CP02Z

24

(e) The data required in paragraphs (c) and (d) of this clause shall be delivered to the NASA 

center receiving activity listed below:

Receiving Officer

NASA/Headquarters

300 E. Street SW

Washington, D.C. 20546

(f) The contractor shall include the substance of this clause, including this paragraph (f), in all 

subcontracts that require delivery of equipment.

(End of clause)

33. GSFC 52.211-101 LIST OF ATTACHMENTS (JUL 2015)

The following documents are attached hereto and made a part of this BPA: 

Attachment Description Date No. of Pages

A Statement of Work 11/13/2015 3

B Direct Labor Rates Matrix 03/18/2015 1

C

Personal Identity Verification 

(PIV) Card Issuance Procedures

February 

2015 5

D

Organizational Conflicts of 

Interest Avoidance Plan 07/22/2015 8

E

IT Security Applicable 

Documents List

December 

2014 11

F IT Security Management Plan 07/22/2015 18

G Safety and Health Plan 05/28/2015 17

 (End of clause)
NNH16CP02Z

Attachment A

1

(Date: 12/09/2015)

Blanket Purchase Agreement

Statement of Work 

Program Title: Business and Administrative Systems Office (BASO)

Program Office: NASA Headquarters’ Office of Budget Management and Systems Support (OBMSS)

I. Introduction

The National Aeronautics and Space Administration (NASA), Business and Administrative 

Systems Office (BASO) within the Office of Budget Management and Systems Support

(OBMSS) at NASA Headquarters (HQ) is responsible for providing comprehensive support for 

a portfolio of business systems including but not limited to SAP Core Financial, Business 

Objects (BOBJ) and Concur Government Edition (CGE). The BASO collaborates with 

organizations such as the Office of the Chief Financial Officer (OCFO) and the NASA 

Enterprise Applications Competency Center (NEACC) to provide support, system updates, and 

financial process information to the NASA HQ as a center user community. 

The government will furnish to the contractor office space, telephone hardware, computer 

hardware and software, and access to required networks. Contractor staff will be required to 

comply with applicable NASA physical security and information technology security 

regulations.

Periodic travel may be required by contractor staff. All travel will be subject to the approval of 

the Contracting Officer Representative (COR).

II. Systems and Modules in Operation

a. Systems within scope include but are not limited to the following:

i. SAP R/3 “Core Financial” (Funds Management (FM), Project Systems (PS), 

Financials (FI), Controlling (CO), Sales and Distribution (SD), and Materials 

Management (MM))

ii. SAP Business Objects (BOBJ)

iii. BOBJ Analysis for Office

iv. Web-based Time and Attendance Systems (WebTADS)

v. Agency Labor Distribution System (ALDS)

vi. Concur Government Edition (CGE)

vii. FarCry, content management system

viii. Bankcard

ix. bReady

x. Contract Management Module (CMM)/PRISM

xi. Human Capital Information Environment (HCIE) Personnel Data Warehouse 

(PDW)

xii. Human Resources Ad Hoc

xiii. Human Resources Management Division (HRMD) Dashboard Access

xiv. Human Resources Test Environment Access 
NNH16CP02Z

Attachment A

2

(Date: 12/09/2015)

xv. Logistics

xvi. Real Property Management (RPM)

III. General Requirements

All services provided by the contractor shall be supervised by contractor management in 

accordance with FAR 37.104. As a minimum, the contractor must furnish staffing at NASA HQ 

during core business hours, (Monday-Friday, 8:00AM to 5:00PM), excluding Federal Holidays 

and other occasions when the NASA HQ facility is closed. Specific hours of operation will be 

identified in the task orders issued under this Blanket Purchase Agreement (BPA).

Contractor management and staff are expected to present a highly professional interface to the 

NASA HQ community. This requires:

a. Client facing staff that present themselves professionally at all times, in person and 

via all available communication mediums such as phone and e-mail;

b. Customer service oriented management and staff;

c. Highly responsive government/customer interface;

d. Professionalism as evidenced by clear and comprehensible operating procedures;

e. On-site contractor management of its staff for internal operations and delivery of 

service.

Contractor staff typically interact with the NMO at JPL, the Regional Finance Office (RFO) and 

the Financial Systems Office (FSO) at the Goddard Space Flight Center (GSFC), the NASA 

Enterprise Applications Competency Center (NEACC) in Huntsville, AL, the agency 

implementation team for each system/module, the local IT services contractor, and each Mission 

Directorate and Mission Support office within the HQ installation, and potentially every NASA 

Field Center.

The contractor will be responsible to support personnel assigned to NASA HQ, including HQ 

staff at the NASA Management Office (NMO) at the Jet Propulsion Laboratory (JPL) in 

Pasadena, CA. Support to the NMO at JPL will be on a remote basis. There is no sustained 

presence by contractor personnel at JPL contemplated in this order. 

The contractor shall adhere to the accessibility requirements to comply with Section 508 of the 

Rehabilitation Act of 1973 specified in Web-based Intranet and Internet Information and 

Applications (1194.22) at

http://www.access-board.gov/sec508/guide/1194.22.htm . 

The contractor shall comply with NASA publishing guidelines and standards.

The contractor shall provide services in the following major categories:

a) end user assistance for the systems supported,

b) business process re-engineering support services, 
NNH16CP02Z

Attachment A

3

(Date: 12/09/2015)

c) change management services (including but not limited to communications, training and 

knowledge management) relative to the systems supported,

d) administration of the BASO Content Management System (CMS), including creating and 

maintaining the BASO and Travel Office websites. 

e) operational sustaining support (including but not limited to, report development, system 

administration, execution of transactional and operational activities, and the creation and 

maintenance of documentation), and

f) implementation support for new initiatives, including new systems and/or new processes.

Periodic travel may be required by contractor staff. All travel will be subject to the approval of 

the Contracting Officer Representative (COR).

IV. Deliverables

Deliverables will be identified the Task Orders issued under this BPA.

ATTACHMENT C

PERSONAL IDENTITY VERTIFICATION (PIV)

CARD ISSUANCE PROCEDURES

FEBRUARY 2015

RFP NNH15526152Q

CONTRACT NNH15CN62Z
NNH16CP02Z

Attachment C

2

(02/2015)

PIV Card Issuance Procedures in accordance with FAR clause 52.204-9, Personal Identity 

Verification of Contractor Personnel

FIPS 201 Appendix A graphically displays the following procedure for the issuance of a PIV credential.

Figure A-1, FIPS 201, Appendix A

The following steps describe the procedures for the NASA Personal Identity Verification Card Issuance 

(PCI) of a PIV credential:

Step 1: 

The Contractor’s Corporate Security Officer (CSO), Program Manager (PM), or Facility Security Officer 

(FSO) submits a formal letter that provides a list of contract employees (applicant) names requesting 

access to the NASA Contracting Officer’s Representative (COR). In the case of a foreign national 

applicant, approval through the NASA Foreign National Management System (NFNMS) must be 

obtained for the visit or assignment before any processing for a PIV credential can take place. Further, if 

the foreign national is not under a contract where a COR has been officially designated, the foreign 

national will provide the information directly to their visit/assignment host, and the host sponsor will 

fulfill the duties of the COR mentioned herein. In each case, the letter shall provide notification of the 

contract or foreign national employee’s (hereafter the “applicant”) full name (first, middle and last), social 

security number (SSN) or NASA Foreign National Management System Visitor Number if the foreign 

national does not have a SSN, and date of birth. If the contract employee has a current satisfactorily 

completed National Agency Check with Inquiries (NACI) or an equivalent or higher degree of 

background investigation, the letter shall indicate the type of investigation, the agency completing the 

investigation, and date the investigation was completed. Also, the letter must specify the risk/sensitivity 

level associated with the position in which each applicant will be working (NPR 1600.1, §4.5 is germane) 
NNH16CP02Z

Attachment C

3

(02/2015)

Further, the letter shall also acknowledge that contract employees may be denied access to NASA 

information or information systems based on an unsatisfactory background investigation/adjudication. . 

After reviewing the letter for completeness and concurring with the risk/sensitivity levels, the COR/host 

must forward the letter to the Center Chief of Security (CCS). The CCS shall review the OPM databases 

(e.g., DCII, PIP, et al.), and take appropriate steps to validate the applicant’s investigation status. 

Requirements for a NACI or other investigation shall be initiated only if necessary.

Applicants who do not currently possess the required level of background investigation shall be directed 

to the e-QIP web site to complete the necessary background investigation forms online. The CCS shall 

provide to the COR/host information and instructions on how to access the e-QIP for each contract or 

foreign national employee requiring access

Step 2:

Upon acceptance of the letter/background information, the applicant will be advised that in order to 

complete the investigative process, he or she must appear in-person before the authorized PIV registrar 

and submit two forms of identity source documents in original form. The identity source documents must 

come from the list of acceptable documents included in Form I-9, Employment Eligibility Verification, 

one which must be a Federal1or State issued picture identification. Fingerprints will be taken at this time. 

The applicant must appear no later than the entry on duty date. 

When the applicant appears, the registrar will electronically scan the submitted documents; any document 

that appears invalid will be rejected by the registrar. The registrar will capture electronically both a facial 

image and fingerprints of the applicant. The information submitted by the applicant will be used to create 

or update the applicant identity record in the Identity Management System (IDMS). 

Step 3:

Upon the applicant’s completion of the investigative document, the CCS reviews the information, and 

resolves discrepancies with the applicant as necessary. When the applicant has appeared in person and 

completed fingerprints, the package is electronically submitted to initiate the NACI. The CCS includes a 

request for feedback on the NAC portion of the NACI at the time the request is submitted.

Step 4:

Prior to authorizing physical access of a contractor employee to a federally-controlled facility or access to 

a Federal information system, the CCS will ensure that a check has been performed with the National 

Crime Information Center (NCIC) and Interstate Identification Index. In the case of a foreign national, 

a national check of the Bureau of Immigration and Customs Enforcement (BICE) database will be 

performed for each applicant. If this process yields negative information, the CCS will immediately notify 

the COR/host of the determination regarding access made by the CCS.

Step 5:

Upon receipt of the completed NAC, the CCS will update IDMS from the NAC portion of the NACI and 

indicate the result of the suitability determination. If an unsatisfactory suitability determination is 

 

1 A non-PIV government identification badge, including the NASA Photo Identification Badge, MAY NOT BE USED for the 

original issuance of a PIV vetted credential
NNH16CP02Z

Attachment C

4

(02/2015)

rendered, the COR will advise the contractor that the employee is being denied physical access to all 

federally-controlled facilities and Federal information systems. 

Based on a favorable NAC and NCIC/III or BICE check, the CCS will authorize the issuance of a PIV 

federal credential in the Physical Access Control System (PACS) database. The CCS, based on 

information provided by the COR/host, will determine what physical access the applicant should be 

granted once the PIV issues the credential.

Step 6:

Using the information provided by the applicant during his or her in-person appearance, the PIV card 

production facility creates and instantiates the approved PIV card for the applicant with an activation date 

commensurate with the applicant’s start date.

Step 7:

The applicant proceeds to the credential issuance facility to begin processing for receipt of his/her federal 

credential.

The applicant provides to the credential issuing operator proof of identity with documentation that meets 

the requirements of FIPS 201 (DHS Employment Eligibility Verification (Form I-9) documents. These 

documents must be the same documents submitted for registration. 

The credential issuing operator will verify that the facial image, and optionally reference finger print, 

matches the enrollment data used to produce the card. Upon verification of identity, the operator will 

locate the employee’s record in the PACS database, and modify the record to indicate the PIV card has 

been issued. The applicant will select a PIN for use with his or her new PIV card. Although root data is 

inaccessible to the operator, certain fields (hair color, eye color, et al.) may be modified to more 

accurately record the employee’s information.

The applicant proceeds to a kiosk or other workstation to complete activation of the PIV card using the 

initial PIN entered at card issuance.
NNH16CP02Z

Attachment C

5

(02/2015)

ALTERNATIVE FOR APPLICANTS WHO DO NOT HAVE A COMPLETED AND 

ADJUDICATED NAC AT THE TIME OF ENTRANCE ON DUTY

Steps 1 through 4 shall be accomplished for all applicants in accordance with the process described above. 

If the applicant is unable to appear in person until the time of entry on duty, or does not, for any other 

reason, have a completed and adjudicated NAC portion of the NACI at the time of entrance on duty, the 

following interim procedures shall apply.

1. If the documents required to submit the NACI have not been completed prior to EOD, the 

applicant will be instructed to complete all remaining requirements for submission of the 

investigation request. This includes presentation of I-9 documents and completion of fingerprints, 

if not already accomplished. If the applicant fails to complete these activities as prescribed in 

NPR 1600.1 (Chapters 3 & 4), it may be considered as failure to meet the conditions required for 

physical access to a federally-controlled facility or access to a Federal information system, and 

result in denial of such access.

2. Based on favorable results of the NCIC, the applicant shall be issued a temporary NASA 

identification card for a period not-to-exceed six months. If at the end of the six month period the 

NAC results have not been returned, the agency will at that time make a determination if an 

additional extension will be granted for the temporary identification card.

3. Upon return of the completed NAC, the process will continue from Step 5.
NASA BASO

Organizational Conflict of Interest (OCI) Plan

National Aeronautics and Space Administration

Business and Administrative Systems Office

July 21, 2015

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page iii of 8 BASO OCI Plan_v1.docx

Organizational Conflict of intrest Plan 

 

Table of Contents 

1 Overview ............................................................................................................................................... 4

1.1 Definitions ...................................................................................................................................... 4

1.2 BASO Specific OCI Avoidance....................................................................................................... 4

1.3 Deloitte Corporate Structure ........................................................................................................... 4

2 Plan ........................................................................................................................................................ 6

2.1 Detailed Procedures ....................................................................................................................... 6

2.1.1 Firewall .................................................................................................................................. 6

2.1.2 Training ................................................................................................................................. 6

2.1.3 Non-Disclosure Obligations .................................................................................................. 6

2.1.4 Plan Manager ........................................................................................................................ 6

2.1.5 NASA Audit Rights ................................................................................................................ 7

2.1.6 Updating and Reporting ........................................................................................................ 7

3 Nondisclosure Agreement................................................................................................................... 8

Organizational Conflict of intrest Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 5 of 8 BASO_OCI_Plan_FINAL.docx.docx 

Deloitte LLP provides management oversight and various administrative services to its subsidiaries, but 

does not provide client services. Client services are provided by its function-specific subsidiaries (“FSSs”) 

listed below (or their respective subsidiaries): 

· Deloitte & Touche LLP provides audit and enterprise risk services 

· Deloitte Consulting LLP provides consulting services, including human capital and outsourcing 

services 

· Deloitte Financial Advisory Services LLP provides financial advisory services, consisting of forensic 

and dispute, reorganization, valuation, and corporate finance services 

· Deloitte Tax LLP provides tax services. 

Each FSS operates as an independent entity with its own governance structure. Each FSS has its own 

chief executive officer and board of directors. 

Each FSS enters into client engagements independently. To the extent that services of professionals from 

another FSS are required in connection with an engagement, those services are provided to the engaged 

FSS under the terms of a subcontracting agreement. 


Organizational Conflict of intrest Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 8 of 8 BASO_OCI_Plan_FINAL.docx.docx 

3 Nondisclosure Agreement 

Nondisclosure Agreement & OCI Statement

I, , understand that during the course of my performance of duties on 

the NASA Business and Administrative Systems Office engagement (the “Engagement”), I may be 

exposed to certain sensitive and other non-public NASA information. 

(1) I agree not to disclose any non-public NASA information obtained under the Engagement to any 

person or entity, other than other persons who are bound by these restrictions. 

. 

(2) I understand the requirements of the Organizational Conflict of Interest Mitigation Plan and agree to 

comply with such Plan. 

Company Deloitte Consulting LLP 

Name 

Title

Signature 
ATTACHMENT E

INFORMATION TECHNOLOGY (IT) SECURITY

APPLICABLE DOCUMENTS LIST

December 2014

RFP NNH15526152Q

CONTRACT NNH16CP02Z
NNH16CP02Z

Attachment E

2

(12/2014)

Information Technology (IT) Security Applicable Documents List

December 2014

NASA Policy Directives (NPD) and NASA Procedural Requirements (NPR)

Document Subject Effective Date

NPR 1382.1A NASA Privacy Procedural Requirements July 10, 2013

NPD 1382.17H NASA Privacy Policy June 24, 2009

NPD 1440.6I NASA Records Management Sept 10, 2014

NPR 1441.1D NASA Records Retention Schedules (w/Change 5, 

6/29/09)

February 24, 2003

NPD 2540.1G

Personal Use of Government Office Equipment 

Including Information Technology June 08, 2010

NPD 2800.1B Managing Information Technology March 21, 2008

NPR 2800.1B Managing Information Technology March 20, 2009

NPD 2810.1D NASA Information Security Policy May 9, 2009

NPR 2810.1A Security of Information Technology w/ Change 1, 

May 19, 2011) May 16, 2006

NPD 2830.1A NASA Enterprise Architecture November 2, 2011

NPR 2830.1A NASA Enterprise Architecture Procedures December 19, 2013

NPR 2841.1 Identity, Credential, and Access Management January 6, 2011

NASA Interim Directive

Document Subject Effective Date

NID 7120.99 NASA Information Technology and Institutional

Infrastructure Program and Project Management

Requirements

December 22, 2011
NNH16CP02Z

Attachment E

3

(12/2014)

SOPs (ITS-SOP) and Handbooks (ITS-HBK)

Document Subject Effective Date

ITS-HBK-2810.00-01B

Format and Procedures for an IT Security 

Handbook

June 19, 2014

ITS-HBK-2810.00-02A Roles and Responsibilities Crosswalk May 2, 2013

ITS-HBK-2810.02-01 Security Assessment and Authorization May 6, 2011

ITS-HBK-2810.02-02

Security Assessment and Authorization: FIPS 

199 Moderate & High Systems

October 24, 2012

ITS-HBK-2810.02-03

Security Assessment and Authorization: FIPS 

199 Low Systems

October 24, 2012

ITS-HBK-2810.02-04A

Security Assessment and Authorization: 

Continuous Monitoring – Annual Security 

Control Assessments

March 18, 2014

ITS-HBK-2810.02-05 Security Assessment and Authorization: 

External Information Systems 

October 24, 2012

ITS-HBK-2810.02-06

Security Assessment and Authorization: 

Extending and Information Systems 

Authorization to Operate Process and 

Templates 

October 24, 2012

ITS-HBK-2810.02-07

Security Assessment and Authorization: 

Information System Security Plan Numbering 

Schema

February 27, 2012

ITS-HBK-2810.02-08A

Security Assessment and Authorization: Plan of 

Action and Milestones (POA&M)

December 11, 2013

ITS-HBK-2810.03-01 Planning May 6, 2011

ITS-HBK-2810.03-02

Planning: Information System Security Plan 

Template, Requirements, Guidance and 

Examples

February 9, 2011
NNH16CP02Z

Attachment E

4

(12/2014)

SOPs (ITS-SOP) and Handbooks (ITS-HBK)

Document Subject Effective Date

ITS-HBK-2810.04-01-A

Risk Assessment: Security Categorization, Risk 

Assessment, Vulnerability Scanning, Expedited 

Patching & Organizationally Defined Values

October 12, 2012

ITS-HBK-2810.04-02-A

Risk Assessment: Procedures for Information 

System Security Penetration Testing and Rules 

of Engagement

April 30, 2013

ITS-HBK-2810.04-03

Risk Assessment: Web Application Security 

Program

April 30, 2013

ITS-HBK-2810.05-01 Systems and Service Acquisition November 21, 2011

ITS-HBK-2810.06-01 Awareness and Training May 6, 2011

ITS-HBK-2810.07-01 Configuration Management May 6, 2011

ITS-HBK-2810.08-01 Contingency Planning April 26, 2012

ITS-HBK-2810.08-02

Contingency Planning: Guidance and 

Templates for Plan Development, Maintenance 

and Test

February 11, 2011

ITS-HBK-2810.09-01 Incident Response and Management May 6, 2011

ITS-HBK-2810.09-02

Incident Response and Management: NASA 

Information Security Incident Management

August 24, 2011

ITS-HBK-2810.09-03

Incident Response and Management: Targeted 

Collection of Electronic Data

August 24, 2011

ITS-HBK-2810.10-01 Maintenance May 6, 2011

ITS-HBK-2810.11-01-A Media Protection July 13, 2012

ITS-HBK-2810.11-02 Media Protection: Digital Media Sanitization July 13, 2012

ITS-HBK-2810.12-01 Physical and Environmental Protection May 6, 2011

ITS-HBK-2810.13-01 Personnel Security May 6, 2011

ITS-HBK-2810.14-01 System and Information Integrity May 6, 2011
NNH16CP02Z

Attachment E

5

(12/2014)

SOPs (ITS-SOP) and Handbooks (ITS-HBK)

Document Subject Effective Date

ITS-HBK-2810.15-01-A Access Control September 4, 2012

ITS-HBK-2810.15-02-A Access Control: Elevated Privileges (EP) September 20, 2012

ITS-HBK-2810.16-01 Audit and Accountability May 6, 2011

ITS-HBK-2810.17-01 Identification and Authentication May 6, 2011

ITS-HBK-2810.18-01 System and Communications Protection May 6, 2011

Standards

Document Subject Effective Date

EA-STD 0001.0 Standard for Integrating Applications into the 

NASA Access Management, Authentication, and 

Authorization Infrastructure

August 1, 2008

EA-SOP 0003.0 Procedures for Submitting a NASA Agency 

Forest (NAF) Deviation Request and Transition 

Plan

August 1, 2008

EA-SOP 0004.0 Procedures for Submitting an Application 

Integration Deviation Request and Transition 

Plan

August 1, 2008

NASA-STD-2804-P Minimum Interoperability Software Suite March 14, 2014

NASA-STD-2805-P Minimum Hardware Configurations March 14, 2014
NNH16CP02Z

Attachment E

6

(12/2014)

Memoranda

From To Subject Effective 

Date

Posted 

Date

NASA CIO and 

Deputy CIO for 

IT Security

Distribution Updated Password Requirements 

for AA Accounts

7/2/2014 7/2/2014

Chief 

Information 

Officer

Distribution Establishment and Maintenance of 

Secure Communications

2/28/2014 2/28/2014

Deputy Chief 

Information 

Officer for 

Information 

Technology 

Security

Distribution Implementation ofNational 

Institute of Standards and 

Technology Special Publication 

800-53, Revision 4

12/19/2013 12/19/2013

Chief

Information 

Officer

Distribution Minimum Security Requirements 

for Personal Mobile Devices

8/27/2013 8/27/2013

Chief 

Information 

Officer

Distribution Additional 90-day extension: 

Blanket waiver for use of Filevault 

2.0 to meet Data at Rest (DAR) 

Encryption Requirements

5/7/2013 5/7/2013

Office of the 

Chief 

Information 

Officer

Distribution Delegation of Authorizing Official 

Designation to Center and Mission

Directorate Chief Information 

Officers

4/2/2013 4/2/2013

Deputy CIO for 

Information 

Security

Distribution NASA ACES Secure Virtual Team 

Meeting (SVTM) Approved for 

Secure Meetings and 

Communication of SBU Data

2/5/2013 2/5/2013

Chief 

Information 

Officer

Distribution Cancellation of PDM 2012-064 

Data At Rest (DAR) Waiver 

Process and issuance of a new 

PDM addressing Alternate DAR 

Encryption Products

1/27/2013 1/27/2013
NNH16CP02Z

Attachment E

7

(12/2014)

Memoranda

From To Subject Effective 

Date

Posted 

Date

Deputy CIO for 

Information 

Technology 

Security

Center 

Mission 

Directorate 

Chief

Information 

Officers (CIO)

Configuration Guidance for 

Computer Operating Systems

12/17/2012 12/17/2012

Associate 

Deputy 

Administrator

All NASA 

Employees

Breach of Personally Identifiable 

Information (PII) [Laptop 

DAR/Encryption]

11/13/2012 11/13/2012

Chief 

Information 

Officer

All NASA 

Center CIO's

Rescinding and/or Archiving 

Information Technology (IT) 

Security Memoranda

9/20/2012 9/20/2012

Deputy CIO for 

Information 

Security

All NASA 

Center CIOs

FY2012 FISMA Awareness and 

Training Reporting Metrics

9/12/2012 9/12/2012

OCIO Distribution Acceptance of other Federal IT 

Security Awareness Training to 

Satisfy NASA's

FISMA Requirements

5/25/2012 5/25/2012

Charles F. 

Bolden, Jr., 

NASA 

Administrator

All NASA 

Employees

Protection of Sensitive Agency 

Information

4/3/2012 4/3/2012

Assistant 

Administrator for 

Security and 

Program 

Protection, Chief 

Information 

Officer (Acting)

NASA Center 

Directors

Identity, Credential, and Access 

Management Business Process 

Leads

8/27/2009 8/27/2009
NNH16CP02Z

Attachment E

8

(12/2014)

Memoranda

From To Subject Effective 

Date

Posted 

Date

Chief 

Information 

Officer (Acting)

Officials-inCharge of 

Headquarters, 

Center CIOs, 

Mission 

Directorate 

CIOs

Security and Support Policy for 

Smartphones

8/3/2009 8/3/2009

Chief 

Information 

Officer (Acting)

Center CIOs Delegation of Waiver Authority 

and Responsibility for Vulnerability 

Scanning Requirements

5/6/2009 5/6/2009

Chief 

Information 

Officer (Acting)

Officials-inCharge of 

Headquarters 

Offices, NASA 

Center 

Directors

Roles and Responsibilities for 

Protecting NASA Sensitive But 

Unclassified (SBU) Information

4/27/2009 4/27/2009

Deputy CIO for 

IT Security

Center CIOs, 

Center ITSMs

FY 2009 Scanning and 

Vulnerability Elimination or 

Mitigation

2/06/2009 2/06/2009

Chief 

Information 

Officer

Officials-inCharge of 

Headquarters 

Offices, NASA 

Center 

Directors

Personally Identifiable Information 

(PII) Incident Reporting

1/14/2009 1/14/2009

Chief 

Information 

Officer

All NASA Civil 

Service and 

Contractor 

Employees

Policy for Use of Removable 

Media, Such as USB Thumb 

Drives

11/21/2008 11/21/2008

Senior Agency 

Official for 

Privacy

Official-inCharge of 

Headquarters 

Offices, NASA 

Center 

Directors

Personally Identifiable Information 

(PII) Responsibilities Statement

9/8/2008 9/8/2008
NNH16CP02Z

Attachment E

9

(12/2014)

Memoranda

From To Subject Effective 

Date

Posted 

Date

Chief 

Information 

Officer

Center CIOs Deployment of the Software 

Refresh Portal

7/30/2008 7/30/2008

Chief 

Information 

Officer

NASA CIOs, 

Mission 

Directorate 

CIOs, Center 

ITSMs, Center 

Human 

Resources 

Directors, 

IEMP

Requirement to Log and Verify 

Sensitive Data Extracts

6/9/2008 6/9/2008

Chief 

Information 

Officer

NASA CIOs, 

Mission 

Directorate 

CIOs, Center 

ITSMs, Center 

ITSMs, Center 

Human 

Resources 

Directors, 

IEMP

Remote Access to Personally 

Identifiable Information (PII)

6/9/2008 6/9/2008

Deputy CIO for 

IT Security

Center ITSMs Clarification on Requirement for 

Contractors to Complete NASA 

Annual IT Security Awareness 

Training

6/6/2008 6/6/2008

Deputy CIO for 

IT Security

Center CIOs, 

Center ITSMs

System Security Documentation in 

RMS

2/20/2008 2/20/2008

Chief 

Information 

Officer

Center CIOs, 

Deputy CIOs

Information Discovery 2/4/2008 2/4/2008

Deputy CIO for 

IT Security

Center CIOs, 

Center ITSMs

Decision to Cancel Procurement 

Information Circular (PIC) 04-03 

(System Administrator 

Certification Program)

1/16/2008 1/16/2008
NNH16CP02Z

Attachment E

10

(12/2014)

Memoranda

From To Subject Effective 

Date

Posted 

Date

Chief 

Information 

Officer

Official-inCharge of 

Headquarters 

Offices, NASA 

Center 

Directors

Release of NPD 2200.1A, 

Management of NASA Scientific 

and Technical Information

12/18/2007 12/18/2007

Deputy CIO for 

IT Security

Center CIOs, 

Mission 

Directorate 

CIOs

Agency Security Configuration 

Standards: Federal Desktop Core 

Configurations

11/15/2007 11/15/2007

Chief 

Information 

Officer

Center Chief 

Information 

Officers

Designation of FIPS-199 Impact 

Level for NASA's OAIT Voice 

Systems

7/10/2007 7/10/2007

Chief 

Information 

Officer

Center Chief 

Information 

Officers

Designation of FIPS-199 Impact 

Level for NASA OAIT Data Center 

Systems

7/10/2007 7/10/2007

Chief 

Information 

Officer

Center Chief 

Information 

Officers

Designation of FIPS-199 Impact 

Level for NASA OAIT LANs

7/10/2007 7/10/2007

Chief 

Information 

Officer (Acting)

Center CIOs, 

Mission 

Directorate 

CIOs

Meeting OMB Memoranda M-06-

015 "Safeguarding Personally 

Identifiable Information;" M-06-016 

"Protection of Sensitive Agency 

Information," and M-06-019 

"Reporting Incidents Involving 

Personally Identifiable Information 

and Incorporating the Cost for 

Security in Agency Information 

Technology Investments"

10/17/2006 10/17/2006
NNH16CP02Z

Attachment E

11

(12/2014)

Memoranda

From To Subject Effective 

Date

Posted 

Date

Deputy 

Administrator

Administrator/

Official-inCharge of 

Headquarters 

Offices, NASA 

Center 

Directors

Meeting NASA Information 

Technology Security 

Requirements

7/26/2006 7/26/2006

Deputy CIO for 

IT Security

Center CIOs Designation of FIPS-199 Impact 

Level for NASA OAIT Desktop 

Systems

4/16/06 4/16/06

Chief 

Information 

Officer, Chief of 

Strategic 

Communications

Official-inCharge of 

Headquarters 

Offices, NASA 

Center 

Directors, 

Center CIOs, 

Mission 

Directorate 

CIOs

Policy Governing NASA's Publicly 

Accessible Web sites

3/16/2006 3/16/2006

Chief 

Information 

Officer, Assistant 

Administrator of 

Public Affairs

Center CIOs Update of NASA Web site Linking 

Policy

12/15/2005 12/15/2005

Chief 

Information 

Officer

Center CIOs Update of NASA Web site Privacy 

Policy

11/28/2005 11/28/2005

Reminder: Within 30 days after contract effective date, the Contractor shall develop and 

deliver an IT Security Management Plan to the Contracting Officer for approval. 
NASA BASO 

IT Security Management Plan 

National Aeronautics and Space Administration 

 Business and Administrative Systems Office 

July 21, 2015

BASO IT Security Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page iii of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

Table of Contents 

1 Overview ................................................................................................................................................ 4

1.1 BASO Services Summary .............................................................................................................. 4

1.1.1 Operational Help Desk .......................................................................................................... 4

1.1.2 Change Management ............................................................................................................ 4

1.1.3 Sustaining Support ................................................................................................................ 4

1.1.4 HQ Travel Office ................................................................................................................... 4

1.2 Definitions ....................................................................................................................................... 4

1.3 System Identification ...................................................................................................................... 5

2 Management Controls .......................................................................................................................... 8

2.1 Return of Information and IT Resources ........................................................................................ 8

3 Operational Controls ............................................................................................................................ 9

3.1 Personnel Security.......................................................................................................................... 9

3.2 Physical and Environmental Protection .......................................................................................... 9

3.3 Production, Input/Output Controls .................................................................................................. 9

3.3.1 Business and Administrative Systems Office ........................................................................ 9

3.3.2 HQ Travel Office ................................................................................................................. 12

3.3.3 Center Security Administrator ............................................................................................. 14

3.4 Documentation .............................................................................................................................. 15

3.5 Security Awareness and Training ................................................................................................. 15

3.6 PII ................................................................................................................................................. 15

4 Appendices ......................................................................................................................................... 17

Appendix A - 1852.204-76 Security Requirements for UNCLASSIFIED Information Technology 

Resources (Jan 2011) Compliance with Security Requirements ......................................................... 17
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 4 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

1 Overview 

The BASO IT Security Management Plan describes the processes and procedures that the BASO team 

will follow in order to safeguard information technology (IT) resources under the BASO contract. This plan 

provides a summary of BASO services, defines the systems accessible to the BASO team, and identifies 

BASO management and operational controls. 

1.1 BASO Services Summary 

The purpose of this contract is to deliver services to the Business and Administrative Systems Office 

(BASO) to business offices and users located at NASA HQ in Washington, DC and remotely to users at 

the Jet Propulsion Laboratory’s (JPL) NASA Management Office (NMO) in Pasadena, California. These 

services include management of operational support centers (BASO and HQ Travel Office services), 

change management services and sustaining support activities. 

1.1.1 Operational Help Desk 

The BASO provides general support to users for business applications including SAP Core Financial, 

Business Objects, Web-based Time and Attendance Systems (WebTADS), Agency Labor Distribution 

System (ALDS), Concur Government Edition (CGE), FarCry (content management system), Bankcard, 

bReady, Contract Management Module (CMM)/PRISM, Human Capital Information Environment (HCIE) 

Personnel Data Warehouse (PDW), Human Resources Ad Hoc, Human Resources Management Division 

(HRMD) Dashboard Access, Human Resources Test Environment Access, Logistics, Real Property 

Management (RPM) and any successor applications. 

1.1.2 Change Management 

The BASO provides change management services across the systems and processes supported by the 

BASO including disseminating communications, delivering training and managing the BASO website. 

1.1.3 Sustaining Support 

The BASO performs defined sustaining support activities for BASO supported software and applications 

including report development, SR monitoring, Center Level Funds Distribution, and support for releases 

and year end. 

BASO sustaining support activities encompass the roles and responsibilities of the Center Security 

Administrator (CSA). The CSA is responsible for creating, maintaining and provisioning approved NASA 

user accounts and associated roles. This position encompasses responsibilities relating to provisioning 

and approval of NASA user accounts and roles in the systems identified in the Operational Help Desk 

section of this document. 

1.1.4 HQ Travel Office 

The HQ Travel Office performs defined sustaining support activities for HQ Travel Office supported 

software and applications including Job Title/Workgroup Approval Chain maintenance, Travel Card report 

processing and analysis, Invitational Travel account setup and processing, support for releases and year 

end. 

1.2 Definitions 

The following definitions are applicable to the BASO IT Security Management Plan. 

• IT Resources - means any hardware or software or interconnected system or subsystem of 

equipment, that is used to process, manage, access, or store electronic information. 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 5 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

• NASA Electronic Information - is any data (as defined in the Rights in Data clause of this

contract) or information (including information incidental to contract administration, such as 

financial, administrative, cost or pricing, or management information) that is processed, managed, 

accessed or stored on an IT system(s) in the performance of a NASA contract. 

• IT Security Management Plan - describes the processes and procedures that will be followed to 

ensure appropriate security of IT resources that are developed, processed, or used under this 

contract. Unlike the IT security plan, which addresses the IT system, the IT Security Management 

Plan addresses how the contractor will manage personnel and processes associated with IT 

Security on the instant contract. 

• IT Security Plan—this is a FISMA requirement; see the ADL for applicable requirements. The IT 

Security Plan is specific to the IT System and not the contract. Within 30 days after award, the 

contractor shall develop and deliver an IT Security Management Plan to the Contracting Officer; 

the approval authority will be included in the ADL. 

1.3 System Identification 

The BASO team does not perform any system development or maintenance services. Access to these 

business systems is limited to BASO staff performing assigned tasks. 

System Name Description Responsible 

Organization Status 

SAP SAP Core Financial – includes the following SAP 

modules: Funds Management (FM), Project 

Systems (PS), Financials (FI), Controlling (CO), 

Sales and Distribution (SD) and Materials 

Management (MM). Fully implemented in June 

2003 as NASA’s Agency wide financial system 

offering users both transactional functionality and 

real time reporting capabilities. 

NEACC Operational 

Business 

Objects (BOBJ) 

BOBJ is a web-based reporting tool that enables 

agency-wide analysis of data from SAP and other 

business applications. 

NEACC Operational 

PaymentNet PaymentNet is the system used to administer and 

manage the U.S. Government Travel Charge Card 

Program. 

JPMorgan 

Chase 

Operational 

Concur 

Government 

Edition (CGE) 

CGE is the ETS2 software selected by NASA to 

serve as the travel system for the Agency. The 

application enables the booking of travel 

reservations and creation of associated materials 

used to document and approve all Agency travel. 

Concur Operational 

Agency Labor 

Distribution 

System (ALDS) 

ALDS was implemented Agency-wide with the first 

pay period in FY 2006. ALDS created one system 

of record for labor distribution data. The ALDS 

system is a customized extension to NASA’s Core 

Financial software. 

NEACC Operational 

Bankcard Bankcards are issued to Civil Servants to use to 

purchase items under $3,000.00 so a purchase 

requisition (PR) does not have to be submitted. 

NEACC Operational 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 6 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

System Name Description Responsible 

Organization Status 

The Bankcard role gives users access to the 

Bankcard portal available through bReady. 

CMM/PRISM CMM is the home for NASA’s contract information 

and data. It integrates with NASA’s financial 

system, SAP, to provide detailed obligation 

information by contract. CMM contains a document 

generation system, also known as PRISM, used by 

Contract Specialists to award contractual 

documents. This fully integrated application works 

in conjunction with NASA’s SAP solution and 

serves as a comprehensive tool to support the 

various procurement aspects of NASA’s contract 

administration including solicitation, contract 

modification, award, and closeout. 

NEACC Operational 

Human 

Resource 

Management 

Division (HRMD) 

Dashboard 

The HRMD Dashboard provides information on 

workforce demographics, hiring and recruiting, 

performance, attrition, buyouts, retirement, targets 

and risks. The Human Capital Information 

Environment (HCIE) is a portal that grants access 

to the data source for Human Capital information, 

applications and reporting tools. 

NEACC Operational 

WebTADS WebTADS is an electronic, real-time reporting, 

web-based time and attendance system. NASA 

employees use WebTADS to record time and leave 

information. 

NEACC Operational 

Competency 

Management 

System (CMS) 

The Competency Management System is an 

agency wide system used to store and report on 

employee competencies. 

NEACC Operational 

bReady bReady is the replacement to iView and is a Portal 

to access various business systems and supporting 

information issued by the NEACC. 

NEACC Operational 

SATERN SATERN is NASA’s learning management system 

and used to manage the registration process for 

the BASO training curriculum. 

NEACC Operational 

Human Capital 

Information 

Environment 

(HCIE) 

HCIE is comprised of a portal component 

containing extensive HR data and access to HR 

applications as well as a Data Warehouse (PDW) 

aspect providing user access to HR reports. 

NEACC Operational 

FarCry Open source content management system used to 

maintain and manage the BASO website. 

DMI Operational 

MSFC ISRS and 

successor 

applications 

(Remedy) 

Used to submit Service Requests (SR) – 

corrections, updates or other requested actions to 

an Agency Enterprise system 

NEACC Operational 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 7 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

System Name Description Responsible 

Organization Status 

Cognos Cognos is the replacement business intelligence 

tool for Actuate. The application enables the 

Centers to develop reports and dashboard based 

on user specific requirements. 

NEACC Operational 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 8 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

2 Management Controls 

The Deloitte BASO team is a support function for NASA HQ. In this capacity, our team is not provided 

with any level of configuration access to NASA systems. Additionally, the BASO does not own or operate 

these systems. The Deloitte team will comply with all NASA defined processes and procedures for all 

systems accessed by our team. This will include procedures system owners have defined and provided 

for: 

o Risk Assessment and Management 

o Review of Security Controls 

o Complying with provided Rules of Behaviour 

o Life Cycle Security Planning 

o Initiation Phase 

o Development/Acquisition Phase 

o Implementation Phase 

o Operation/Maintenance Phase 

o Disposal Phase 

o Authorize Processing 

2.1 Return of Information and IT Resources 

At the completion of the BASO contract, the BASO team shall return all NASA information and IT 

resources provided during the performance of the contract in accordance with the retention 

documentation available in the ADL. At the contract end, the BASO team will also provide a listing of all 

NASA Electronic information and IT resources generated during the contract performance and request 

disposition instructions from the Contracting Officer. 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 9 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

3 Operational Controls 

The BASO will comply with the operational security controls defined by NASA for each of the systems 

accessed and supported by BASO staff. Additionally, the BASO will protect the confidentiality, integrity, 

and availability of NASA Electronic Information and IT resources and protect NASA Electronic Information 

from unauthorized disclosure. A description of our approach to compliance is defined in the sections 

below. 

3.1 Personnel Security 

All on site contractor resources for the BASO support contract are required to comply with the 

requirements and steps defined in the NASA’s Personal Identity Verification (PIV) Card Issuance 

Procedures. In addition to completing the required process for badging and physical access, all BASO 

personnel comply with the completion of NAMS requests or other system access request forms, in 

accordance with the procedures for each system. BASO personnel are only provided the level of access 

necessary to perform their assigned support tasks. 

3.2 Physical and Environmental Protection 

The BASO provides a fully functional support desk which is open daily (Monday to Friday 8:00am – 

5:00pm). The BASO is located in NASA HQ, 4th floor, or by phone at 202.358.4367. The HQ Travel Office 

is located in NASA HQ, 4th floor, or by phone at 202.358.2301. The systems supported by the BASO do 

not physically reside within the Support Center. Additionally the responsibility and ownership for the 

maintenance of the hardware/software for these systems is not the BASO. The BASO is responsible for 

complying with the access request procedures and providing support for these systems in accordance to 

the processes defined by the system owners. 

3.3 Production, Input/Output Controls 

As part of the BASO support contract, team members are required to receive access to the various 

business systems to enable them to perform their assigned roles. The table below describes the 

operational roles and access required for the BASO support staff in each of the three project work 

streams: Business and Administrative Systems Office, HQ Travel Office, and Center Security 

Administrator. 

3.3.1 Business and Administrative Systems Office 

System Name Role Access Description 

SAP Read-only Role BASO team members performing general support

functions across SAP are provided full read-only 

capabilities within the system. To obtain this access, the 

Contractor resource must attend internal training and 

submit a NAMS request with justification for approval by 

the COR. In addition, the resource must have completed 

the annual IT Security Training, required by all NASA 

personnel. 

BASO team members have more extensive access to the 

SAP Sandbox/test environment. This type of access 

provides the team with the capability to update or change 

information for purposes of testing solutions or supporting 

training/process documentation. To obtain this access, 

the Contractor resource must submit a NAMS request with 

justification for approval by the COR. In addition, the 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 10 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

System Name Role Access Description 

resource must have completed the annual IT Security 

Training, required by all NASA personnel. 

 Budget Maintainer BASO support staff performing the Center Level Funds 

Distribution process are provided the Center Level Budget 

Maintainer access allowing them to enter transactions to 

move budget based on written requests received from 

approved NASA personnel. 

To obtain this access, the Contractor resource must attend 

the BASO’s Essential NASA Budgeting and FMBB 

Process and Procedures training courses and submit a 

NAMS request with justification for approval by the COR. 

In addition, the resource must have completed the annual 

IT Security Training, required by all NASA personnel. 

BOBJ Report Query Role BASO staff supporting BOBJ have Report Query access 

to the BOBJ reporting system. This access is the same 

access all end-users at HQ and JPL receive to provide 

view-only access to all BOBJ reports. 

To obtain this access, Contractor resource must attend 

internal training and submit a NAMS request for approval 

by the COR. In addition, the resource must have 

completed the annual IT Security Training, required by all 

NASA personnel. 

bReady Read Only Role BASO staff providing general support of bReady are given 

read-only access to the software. 

To obtain this role, the Contractor resource must submit a 

NAMS request with justification to be approved by the 

COR. 

SATERN Level 3 Administrator BASO staff responsible for supporting the BASO learning 

program are provided Level 3 Administrator access to the 

system to input courses and manage course registration. 

To obtain this role, the Contractor resource must attend 

SATERN training and submit a NAMS request with 

justification to be approved by the COR. 

HCIE Read Only Role BASO staff providing general support of HCIE are given 

read-only access to the software. 

To obtain this role, the Contractor resource must submit a 

NAMS request with justification to be approved by the 

COR. 

Far Cry Administrator Role BASO staff members performing system administrator 

roles within the Far Cry application are granted access as 

an administrator. This role does not provide any system 

configuration capabilities. 

To obtain this role, the Contractor resource must review 

the Far Cry user guide and must receive written approval 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 11 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

System Name Role Access Description 

(e.g. email) from the COR. The role is granted by and 

existing Far Cry administrator. 

Editor Role BASO staff members editing content or 

uploading/replacing documents within the Far Cry 

application are granted access as an editor. 

To obtain this role, the Contractor resource must review 

the Far Cry user guide and must receive written approval 

(e.g. email) from the COR. The role is granted by and 

existing Far Cry administrator. 

MSFC ISRS and 

the successor 

application 

(Remedy) 

Anonymous Create and 

Read Role 

All NASA users (including BASO team members) are 

granted the “Anonymous” role for the MSFC ISRS system, 

accessible through the “For Your Information” section of 

bReady. This role allows the BASO resource to create 

Service Requests (SRs) and search and view SRs. 

To obtain this role, please reference the bReady section 

for information on bReady access. 

Registered Create, Read, 

and Edit Role 

BASO staff who provide support for HQ SR monitoring are 

given access to Remedy in an expanded role. This role 

provides access to Remedy via the MSFC ISRS log-in 

screen, rather than via bReady. The user has all of the 

capabilities of the anonymous create and read roles, while 

also having access to edit SRs, change the diary log, and 

view attachments. 

To obtain this role, the Contractor resource must submit a 

NAMS request with justification for approval by the COR. 

Approve Role BASO staff with the CBPL approver role have the same 

roles as described above and the ability to approve SRs 

created within their workflow. The BASO team who have 

this role perform this task as a backup to the Center 

Business Process Lead (CBPL). 

To obtain this role, the Contractor resource must submit a 

NAMS request with justification for approval by the COR. 

Cognos Report Developer Role Technical BASO resources responsible for developing 

reports are granted development access to the Cognos 

system. This role does not provide any administrative 

capabilities. 

To obtain this role, the Contractor resource must attend 

Cognos training and submit a NAMS request with 

justification to be approved by the COR. 

Report Viewer Role BASO staff providing general support of Cognos reports 

are given read-only access to the software. 

To obtain this role, the Contractor resource must attend 

Cognos training and submit a NAMS request with 

justification to be approved by the COR. 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 12 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

3.3.2 HQ Travel Office 

System Name Role Access Description 

SAP Vendor Record 

Creation/Maintenance 

HQ Travel Office support staff and designated BASO 

backups performing the vendor record creation and 

confirmation process for travel reimbursement are 

provided the Travel Payment Processor role, allowing 

them to create a vendor record for invitational travelers 

and confirm the personal information entered. 

Note: Support staff that can create vendor records cannot 

confirm them and vice versa. Staff creating vendor records 

are provisioned the AP Travel Payment Processor 

Z:APTRPYPR role while staff confirming vendor records 

are provisioned AP Travel Payment Processor 

Z:APTRAUPR role. 

Concur 

Government 

Edition (CGE) 

Auditor HQ Travel Office support and designated BASO backups 

are provided with read-only access to the Auditor role 

within CGE. The Auditor role grants use of the Search 

feature, which provides the capability to view all 

authorizations, vouchers and associated documents at 

NASA HQ. 

To obtain this access, approval must be given by the HQ 

Travel Office Lead and a SR submitted to the NEACC. 

Reporting HQ Travel Office support staff and designated BASO 

backups are provided access to the Reporting role within 

CGE. The Reporting role provides the capability to view a 

subset of CGE Cognos reports which are not available to 

other users who have ordinary reporting access. Reports 

accessible with this role include the Routing List Report, 

used to verify CGE Approval Chains. 

To obtain this access, approval must be given by the HQ 

Travel Office Lead and a SR submitted to the NEACC. 

Arranger HQ Travel Office Support staff involved in ETDY 

Management and designated BASO backups are provided 

with Arranger access. The Arranger role within CGE 

grants users the ability to create and modify travel 

reservations and documents for other CGE users. 

PaymentNet Restricted Administrator 

Access 

Access to PaymentNet is granted on a limited basis – only 

one HQ Travel Office support staff member may have 

access to the system. Restricted Administrator Access 

allows for view-only access to all travel cards issued by 

NASA HQ as well as Center level travel card reporting 

access. This role does not grant write or update access to 

PaymentNet. 

To obtain access, approval and submission of the request 

for Administrator access must be sent in writing from the 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 13 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

System Name Role Access Description 

HQ Travel Office Lead to the Center Agency Program 

Coordinator who will arrange access directly with 

JPMorgan Chase. 

IdMAX Invitational Traveler 

ICAM 

HQ Travel Office support staff and designated BASO 

backups performing invitational traveler account creation 

are provided access to the Invitational Traveler role and 

Identity, Credential, and Access Management (ICAM) 

system. The Invitational Traveler and ICAM roles provides 

the capability to search for and create NASA identities and 

provision the IEM3100 eTravel application to the 

associated identity for invitational travelers requiring 

access to CGE. 

To obtain this access, approval must be given by the HQ 

Travel Office Lead and a SR submitted to the NEACC. 

The Contractor resource must also successfully complete 

the Personal Identity Verification (PIV) – ICAM Overview 

training course. 

bReady Read Only Role HQ Travel Office staff providing general support of 

bReady are given read-only access to the software. 

To obtain this role, the Contractor resource must attend 

Actuate training and submit a NAMS request with 

justification to be approved by the COR. 

Far Cry Administrator Role HQ Travel Office staff members performing system 

administrator roles within the Far Cry application are 

granted access as an administrator. This role does not 

provide any system configuration capabilities. 

To obtain this role, the Contractor resource must review 

the Far Cry user guide and must receive written approval 

(e.g. email) from the COR. The role is granted by and 

existing Far Cry administrator. 

Editor Role HQ Travel Office staff members editing content or 

uploading/replacing documents within the Far Cry 

application are granted access as an editor. 

To obtain this role, the Contractor resource must review 

the Far Cry user guide and must receive written approval 

(e.g. email) from the COR. The role is granted by and 

existing Far Cry administrator. 

MSFC ISRS and 

the successor 

application 

(Remedy) 

Anonymous Create and 

Read Role 

All NASA users (including HQ Travel Office team 

members) are granted the “Anonymous” role for the MSFC 

ISRS system, accessible through the “For Your 

Information” section of bReady. This role allows the 

BASO resource to create Service Requests (SRs) and 

search and view SRs. 

To obtain this role, please reference the bReady section 

for information on bReady access. 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 14 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

System Name Role Access Description 

 Registered Create, Read, 

and Edit Role 

HQ Travel Office staff who provide support for HQ travel 

SR monitoring are given access to Remedy in an 

expanded role. This role provides access to Remedy via 

the MSFC ISRS log-in screen, rather than via bReady. 

The user has all of the capabilities of the anonymous 

create and read roles, while also having access to edit 

SRs, change the diary log, and view attachments. 

To obtain this role, the Contractor resource must submit a 

NAMS request with justification for approval by the COR. 

3.3.3 Center Security Administrator 

System Name Role Access Description 

SAP HQ and JPL User 

Administrator 

The CSA and designated backups performing user 

account setup, role modification, and account termination 

are provided the HQ and JPL User Administrator roles. 

To obtain this access, Contractor resource must submit a 

NAMS request for approval by the COR. In addition the 

resource must have completed the annual IT Security 

Training, required by all NASA personnel. 

BOBJ HQ and JPL User 

Administrator 

The CSA and designated backups performing user 

account setup, role modification, and account termination 

are provided the HQ and JPL User Administrator roles. 

To obtain this access, Contractor resource must submit a 

NAMS request for approval by the COR. In addition the 

resource must have completed the annual IT Security 

Training, required by all NASA personnel. 

WebTADS Center Security 

Administrator 

The CSA and designated backups performing user 

account modification are provided access to Center 

Security Administrator role. The Center Security 

Administrator provides the capability to modify user roles 

and assign routing codes for timecard approval. 

To obtain this access, Contractor resource must submit a 

NAMS request for approval by the COR. In addition the 

resource must have completed the annual IT Security 

Training, required by all NASA personnel. 

WAT EAI SAP Security Reports The CSA and designated backups performing user 

account modification are provided access to the SAP 

Security Reports role. This role provides the CSAs the 

capability to view system logs by each NASA center and 

use this information, which includes newly created and 

terminated users in various NEACC systems, to generate 

reports. 

To obtain this access, Contractor resource must submit a 

NAMS request for approval by the COR. In addition the 

resource must have completed the annual IT Security 

Training, required by all NASA personnel. 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 15 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

System Name Role Access Description 

CMM/PRISM Center Security Admin The CSA and designated backups performing user 

account setup and provisioning are provided the Center 

Security Admin role. 

To obtain this access, Contractor resource must submit a 

NAMS request for approval by the COR. In addition the 

resource must have completed the annual IT Security 

Training, required by all NASA personnel.

bReady Read Only Role The CSA is given read-only access to the software. 

To obtain this role, the Contractor resource must attend 

Actuate training and submit a NAMS request with 

justification to be approved by the COR. 

3.4 Documentation 

Documentation for a system supported by BASO includes any information provided by the system owners 

that may include descriptions of the hardware and software, policies, standards, procedures and 

approvals related to automated information system security of the system to include backup and 

contingency activities, as well as descriptions of user and operator procedures. These documents are 

expected to be provided and managed by the system owners. Any documentation the BASO creates in 

support of Help Desk activities are stored and managed within the NASA shared drive. BASO 

documentation may include Help Desk procedures, FAQs, functional training materials, process 

documentation and project plans. 

3.5 Security Awareness and Training 

Security awareness and training including the IT Security Training (via SATERN) is provided by NASA. 

All personnel supporting the BASO are required to complete this training based on the timeline specified 

by NASA. Any additional training required by NASA will be completed by staff and monitored by the 

BASO project management for compliance. 

3.6 PII 

Deloitte and NASA have strict standards for viewing, processing, and handling Personally Identifiable 

Information (PII). All Contractor resources are required by Deloitte to take the Privacy in Practice: The 

Business Imperative training course which details proper processes and procedures related to PII, and 

pass an assessment. Additionally, NASA requires all personnel to take the mandatory IT Security courses 

for all employees: Annual Information Security Training and the NASA HQ Security Awareness Training. 

Personally Identifiable Information (PII) will only be viewed by HQ Travel Office support team members 

and designated BASO backups. The following HQ Travel Office processes will require the viewing and/or 

use of PII: 

• Invitational Travel Form and Account Setup 

• Travel Card Administration 

• Travel Card Application 

• Travel Card Reporting 

When viewing or utilizing PII in any of the above contexts, HQ Travel Office support team members will 

follow an established set of procedures to ensure the security of PII: 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 16 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

Note: No PII is saved on a NASA shared drive or personal desktop. 

Process PII Protection Procedures 

Invitational 

Travel Form 

and Account 

Setup 

Upon receipt of an invitational traveler form via either hand delivery, fax or Entrust 

encrypted email, HQ Travel Office support team members will: 

1. Enter required PII from the invitational travel form into IdMAX 

2. Create vendor record in SAP using PII from the invitational travel form 

3. Confirm vendor record in SAP 

4. If the form is received by hand, file the invitational travel form in the secure file 

cabinet. If received via Entrust encrypted email, print the invitational travel form and 

file the form in the secure file cabinet before deleting the email. 

Travel Card 

Administration 

The designated HQ Travel Office support team member with access to PaymentNet 

will view PII when providing travel card support to users. Access to the system is 

strictly limited and password protected to prevent unauthorized access. Any requests 

for updates to PII in PaymentNet from users will be communicated via either phone or 

Entrust encrypted email. 

Travel Card 

Application 

Upon receipt of a rush travel card application via either hand delivery, fax, or Entrust 

encrypted email, the designated HQ Travel Office support team member with access 

to PaymentNet will: 

1. Verify the validity of all fields on the travel card application 

2. Request supervisory signature of the application from either Barby Birch or Kathi 

Thurston. 

3. Fax the application to JPMorgan Chase 

4. Enter new application into the travel card application tracker 

5. Lock travel card application temporarily in the secure file cabinet 

6. Upon provisioning of the card, complete travel card account setup in PaymentNet 

7. Provide PaymentNet account information to the travel card applicant 

8. File travel card application in the secure file cabinet 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 17 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

4 Appendices 

Appendix A - 1852.204-76 Security Requirements for UNCLASSIFIED

Information Technology Resources (Jan 2011) Compliance with Security 

Requirements 

The table below provides a listing of the security requirements identified in NFS 1852.204-76 and 

identifies the section(s) of the BASO IT Security Management Plan which addresses each requirement. 

Requirement Section of Plan 

Addressing Requirement

(a) The contractor shall protect the confidentiality, integrity, and 

availability of NASA Electronic Information and IT resources and 

protect NASA Electronic Information from unauthorized 

disclosure. 

Section: 3 

(b) This clause is applicable to all NASA contractors and subcontractors that process, manage, access, or store unclassified

electronic information, to include Sensitive But Unclassified 

(SBU) information, for NASA in support of NASA’s missions, 

programs, projects and/or institutional requirements. Applicable 

requirements, regulations, policies, and guidelines are identified 

in the Applicable Documents List (ADL) provided as an 

attachment to the contract. The documents listed in the ADL 

can be found at: 

http://www.nasa.gov/offices/ocio/itsecurity/index.html . For 

policy information considered sensitive, the documents will be 

identified as such in the ADL and made available through the 

Contracting Officer.

Section: 2, 3.6 

(c) Definitions. 

(1) IT resources means any hardware or software or interconnected 

system or subsystem of equipment, that is used to process, 

manage, access, or store electronic information. 

(2) NASA Electronic Information is any data (as defined in the 

Rights in Data clause of this contract) or information (including 

information incidental to contract administration, such as financial, 

administrative, cost or pricing, or management information) that is 

processed, managed, accessed or stored on an IT system(s) in the 

performance of a NASA contract. 

(3) IT Security Management Plan—This plan shall describe the 

processes and procedures that will be followed to ensure 

appropriate security of IT resources that are developed, processed, 

or used under this contract. Unlike the IT security plan, which

addresses the IT system, the IT Security Management Plan 

addresses how the contractor will manage personnel and processes 

associated with IT Security on the instant contract. 

(4) IT Security Plan—this is a FISMA requirement; see the ADL for 

applicable requirements. The IT Security Plan is specific to the IT 

System and not the contract. Within 30 days after award, the 

contractor shall develop and deliver an IT Security Management 

Sections: 1, 1.2, 3.5 
BASO IT Security Management Plan 

© 2015 Deloitte Development LLC. 

All rights reserved. 

Page 18 of 18 BASO_IT Security 

Management_Plan_FINAL.docx 

Plan to the Contracting Officer; the approval authority will be

included in the ADL. 

All contractor personnel requiring physical or logical access to 

NASA IT resources must complete NASA’s annual IT Security 

Awareness training. Refer to the IT Training policy located in the IT 

Security Web site at https://itsecurity.nasa.gov/policies/index.html. 

(d) The contractor shall afford Government access to the 

Contractor’s and subcontractors’ facilities, installations, 

operations, documentation, databases, and personnel used in 

performance of the contract. Access shall be provided to the 

extent required to carry out a program of IT inspection (to 

include vulnerability testing), investigation and audit to 

safeguard against threats and hazards to the integrity, 

availability, and confidentiality of NASA Electronic Information or 

to the function of IT systems operated on behalf of NASA, and 

to preserve evidence of computer crime. 

N/A 

Note: All work performed by 

the BASO is done so using 

NASA issued IT resources, 

the BASO team sits onsite 

in the NASA HQ facility. 

(e) At the completion of the contract, the contractor shall return all 

NASA information and IT resources provided to the contractor 

during the performance of the contract in accordance with 

retention documentation available in the ADL. The contractor 

shall provide a listing of all NASA Electronic information and IT 

resources generated in performance of the contract. At that 

time, the contractor shall request disposition instructions from 

the Contracting Officer. The Contracting Officer will provide 

disposition instructions within 30 calendar days of the 

contractor’s request. Parts of the clause and referenced ADL 

may be waived by the contracting officer, if the contractor’s 

ongoing IT security program meets or exceeds the requirements 

of NASA Procedural Requirements (NPR) 2810.1 in effect at 

time of award. The current version of NPR 2810.1 is referenced 

in the ADL. The contractor shall submit a written waiver request 

to the Contracting Officer within 30 days of award. The waiver 

request will be reviewed by the Center IT Security Manager. If 

approved, the Contractor Officer will notify the contractor, by

contract modification, which parts of the clause or provisions of 

the ADL are waived. 

Section: 2.1 

(f) The contractor shall insert this clause, including this paragraph 

in all subcontracts that process, manage, access or store NASA 

Electronic Information in support of the mission of the Agency. 

N/A 

Note: Deloitte Consulting 

L.L.C. does not have any 

subcontractors providing 

support to the BASO 

Contract. 
National Aeronautics and Space Administration 

(NASA)

Business and Administrative Systems Office 

(BASO)

Safety and Health Plan

Volume I - Offer Volume - Appendix A

Request for Quotation (RFQ): NNH15526152Q 

March 18, 2015 (Revised May 28, 2015)
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Table of Contents

1. Management Leadership and Employee Involvement........................................................... 1

Policy ..................................................................................................................................... 1

Goals and Objectives............................................................................................................. 1

Management Leadership........................................................................................................ 2

Employee Involvement.......................................................................................................... 2

Assignment of Responsibility................................................................................................ 2

Safety Representative.................................................................................................... 3

Company Physician ...................................................................................................... 3

Building Fire Warden ................................................................................................... 3

Designated Safety Official............................................................................................ 3

Provision of Authority ........................................................................................................... 3

Accountability........................................................................................................................ 4

Program Evaluation ............................................................................................................... 4

Safety and Health Program Performance Documentation..................................................... 4

Material Safety Data ..................................................................................................... 5

Hazardous Materials Inventory..................................................................................... 5

Government Access to Safety and Health Program Performance Documentation ............... 5

Review and Modification of Safety Requirements................................................................ 6

Procurement........................................................................................................................... 6

Contractor Relationship with OSHA..................................................................................... 6

Plan Update(s)........................................................................................................................ 6

2. Workplace Analysis............................................................................................................... 7

Process................................................................................................................................... 7

Hazard Identification ............................................................................................................. 7

Inspections............................................................................................................................. 7

Employee Reports of Hazards ............................................................................................... 8

3. Mishap Investigation and Record Analysis........................................................................... 9

Mishap Investigation.............................................................................................................. 9

Mishap Reporting .................................................................................................................. 9

Notification/Reporting Procedures ............................................................................... 9

NASA Mishap Reporting Categorizations.................................................................... 9

Trend Analysis..................................................................................................................... 10

Accident/Incident Summary Report ........................................................................... 10

Log of Occupational Injuries and Illnesses................................................................. 10

4. Hazard Prevention and Control............................................................................................ 12

Hazard Prevention................................................................................................................ 12

Appropriate Controls ........................................................................................................... 12

Hazardous Operations.......................................................................................................... 13

Written Procedures .............................................................................................................. 13

Protective Equipment........................................................................................................... 13

Hazardous Operations Permits............................................................................................. 13

Operations Involving Potential Asbestos Exposures.................................................. 13

Operations Involving Exposures to Toxic or Unhealthful Materials.......................... 13

Operations Involving Hazardous Waste ..................................................................... 14

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 i

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Operations Involving New or Modified Emissions/Discharges to the Environment . 14

Baseline Documentation...................................................................................................... 14

Preventive Maintenance....................................................................................................... 14

Medical Program.................................................................................................................. 14

5. Emergency Response........................................................................................................... 15

Emergency Preparedness..................................................................................................... 15

Fire Prevention..................................................................................................................... 15

6. Safety and Health Training.................................................................................................. 16

Training................................................................................................................................ 16

Certification ......................................................................................................................... 16

Training Documentation and Verification........................................................................... 16

7. References............................................................................................................................ 17

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 ii

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

1. Management Leadership and Employee Involvement

NASA’s Request for Quote offer (RFQ) NNH15526152Q is a

firm-fixed price Blanket Purchase Agreement that shall not 

exceed five years from the date of award. The scope of work

under the agreement is supporting NASA’s Business and 

Administrative Systems Office (BASO) (which includes the 

HQ Travel Office) in providing comprehensive support for a

portfolio of business systems at NASA Headquarters (HQ). 

The contractor may travel to the various NASA locations as 

approved in advance by the Contract Officer Representative 

(COR), but will work primarily at the NASA HQ in 

Washington, DC. The scope and nature of this work will 

include extensive computer use, phone use, occasional travel 

and face-to-face and group meetings. Ergonomic and repetitive 

motion injuries are a natural hazard of extensive computer use. 

However, the scope and nature of this work does not involve 

exposure to chemical, biological, radioactive, or other hazardous materials. The scope and nature 

of this work also is not expected to involve exposure to construction, machinery, confined spaces 

or other physical hazards.

Policy

Deloitte is dedicated to providing a safe and healthy environment for their employees, clients, 

and the public. Guiding the development of this document is the principle that an effective and 

high-quality management and monitoring of Health and Safety should include:

• A clear chain of command for safety and health activities.

• Accountability for safety and health performance.

• Well defined expectations regarding safety and health.

• Well defined task and operational hazards/risks.

• Comprehensive hazard prevention and control methods.

• Recordkeeping requirements, where applicable, to track program progress.

Goals and Objectives

Deloitte’s goal is to promote a safe work environment for our employees, clients and the public 

through the prevention of injuries and accidents. The objective of the Health and Safety plan is to 

assist management and non-supervisory employees in controlling hazards and risks in an attempt 

to minimize employee, client and public exposure to injuries. This Safety and Health Plan 

(“Plan”) is established as Deloitte’s Safety and Health Plan required for NASA RFQ 

NNH15526152Q. It is established in order to provide a work environment, work practices and 

employee conduct conducive to a safe and healthful workplace. This plan applies to all 

employees working under the NASA RFQ NNH15526152Q at NASA facilities. Additionally, 

Deloitte onsite contracted personnel will follow the established Health and Safety direction set 

forth by NASA’s specific agency and building guidance. Any Deloitte offsite contracting 

personnel for the NASA project will follow the established Deloitte Health and Safety direction 

set forth under Deloitte corporate and building guidance. 

Our current NASA 

Projects have experience 

and success in following 

our standard Safety and 

Health Plan

In our more than 10 years of 

working at NASA, Deloitte 

has not experienced any 

Safety and Health related 

incidents. Deloitte 

employees maintain 100% 

understanding and 

compliance with NASA's 

safety training requirements.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 1

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Management Leadership

The Deloitte management team is committed to the principle of providing its employees a place 

of employment which is free from recognized hazards that cause, or are likely to cause, death or 

serious physical harm to employees. The Designated Safety Representative (described below) 

will be a part of Deloitte’s onsite management team and will be responsible for the 

implementation and execution of this plan, and the regular review of safety and health policies 

with the delivery team. Workplace safety and health policies and guidelines will be outlined in 

Deloitte’s internal onboarding document and training materials and will be reviewed bi-annually 

at one of the monthly internal team meetings. 

Employee Involvement

While Deloitte is dedicated to providing a safe working environment, our employees must 

understand and comply with the rules of safety established for his or her protection and for the 

protection of others. Our employees will be informed of this plan upon commencement with the 

project to make certain they understand their responsibility to uphold this plan. All members of 

the team will be responsible for reviewing the safety and health policies and guidelines in 

Deloitte’s internal onboarding document. They will also be required to take Deloitte’s internal 

Workplace Health and Safety (WH&S) Awareness Training, which provides our practitioners 

with an understanding of Deloitte’s WH&S policies, processes and procedures and covers

legislation and responsibilities, emergency preparedness, risk management, consultation and 

injury management. All team members are required to obtain a passing grade on the post-course 

assessment to complete this requirements.

Team members will also participate in regular self-inspections of their workspace (as described 

in the onboarding document), in accordance with NASA and Deloitte policies, and will be 

required to report any potential issues to the Designated Safety Official and NASA leadership. 

This includes participation in close call/mishap investigations.

Assignment of Responsibility

Deloitte is committed to the principle of providing its employees a place of employment that is 

free from recognized hazards that cause, or are likely to cause, death or serious physical harm to 

employees. It is the responsibility of all employees to work in as safe and healthy a manner as is 

possible. It is also the responsibility of all employees to report any unsafe or unhealthy working 

conditions. 

It is recognized that many aspects of the work environment are not under the control of the 

Deloitte management team as a result of NASA’s jurisdiction over onsite environment and 

building control. Notwithstanding, our onsite project team and the appointed Safety 

Representative will endeavor to assist with and take corrective action where such corrective 

action is deemed to be in the best safety and health interests of employees. The Deloitte Safety 

Representative will see that appropriate coordination is carried out with the COR and/or 

representative(s) of NASA assigned to the facility occupied by the employees under this work 

effort.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 2

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Deloitte offsite contracting personnel for the NASA project will follow the established Deloitte 

Health and Safety direction set forth for Deloitte corporate and building guidance. Deloitte onsite 

contracting personnel will follow the established Deloitte Health and Safety direction set forth by 

NASA specific agency and building guidance. 

Dorothy Rader is Deloitte’s Senior Lead of Federal Security. She is also the main point of 

contact at Deloitte Headquarters concerning health and safety matters and can be reached at 

(571) 882-8907 or drader@deloitte.com.

Safety Representative

Deloitte will assign the responsibility and titles of Safety Representative for the contract related 

to RFQ NNH15526152Q within 10 days of the solicitation’s award. The designated Safety 

Representative is responsible for our adherence to Center-wide safety, health, environmental, and 

fire protection concerns and goals, and will participate in meeting and other activities related to 

the Center’s Safety and Health Program.

Company Physician

Consultations with a physician will be coordinated by Deloitte Headquarters concerning health 

and safety matters. If required, Dorothy Rader is our POC and she can be reached at (571) 882-

8907 or drader@deloitte.com.

Building Fire Warden

Deloitte will assign a Building Fire Warden for the contract related to RFQ NNH15526152Q

within 10 days of the solicitation’s award. The designated Building Fire Warden is responsible 

for coordination of fire-related issues with the NASA facility manager and emergency 

planning/response officials.

Designated Safety Official

Deloitte will assign a Designated Safety Official for the contract related to RFQ 

NNH15526152Q within 10 days of the solicitation’s award. The Designated Safety Official is 

responsible for the implementation of this plan and any required contact with regulatory agencies 

or with NASA Headquarters; and as applicable with the NASA Headquarters Safety Officer; 

Contracting Officer; or other government personnel or designees for planned communication and 

interfaces.

Deloitte will notify the Contracting Officer and NASA Headquarters Safety Officer, of any 

designated Safety Official and/or Safety Representative replacements within 30 days of 

replacement.

Provision of Authority

The Deloitte appointed Safety Representative is responsible for guiding and monitoring the 

implementation of this plan. It is each employee's responsibility to assist in the implementation

and enforcement of this plan.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 3

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Accountability

Employees are responsible for carrying out their tasks in a safe and healthful manner. The 

Deloitte Safety Representative will encourage employees to sustain safety vigilance by 

promoting and engaging this safety and health plan as well as the References listed at the end of 

the plan. The Deloitte Safety Representative is responsible for taking corrective action with any 

employee who is not implementing their tasks in a safe and healthful manner. Any violations will 

be reviewed by the Safety Representative and escalated to NASA using the appropriate reporting 

mechanisms. Corrective actions will be identified and the employee responsible for the violation 

will be reprimanded accordingly, with considerations for the severity and recurrence of the 

violation. Employees may receive a warning, be required to take additional training classes 

(NASA and/or Deloitte training), or may be removed from the project, pending the review of the 

incident by the Safety Representative and NASA officials.

Program Evaluation

The annual Safety and Health Plan Program Evaluation will be performance based and will 

provide details on the execution of the Safety and Health policies throughout the contract year. It 

will include the name of Deloitte’s Safety Representative and anyone involved in conducting 

Safety and Health reviews and evaluations (including self-inspections), the approach and 

frequency of risk evaluations for the contract year, risks and issues identified, risk mitigation 

strategies/issue management, the status of any Safety and Health risks/issues, and measure the 

effectiveness of applicable compliance and safety training. It will also identify any updates to the 

overall Safety and Health Plan and the schedule for future reviews. The Program Evaluation will 

be a word-based document and will be delivered to the Contracting Officer Representative 

(COR) in both an electronic and hard-copy format (via email/shared drive, etc.).

The annual Safety and Health Plan Program Evaluation will be the responsibility of the 

designated Safety Representative. It will be conducted with the full cooperation of the Deloitte 

employees engaged on the contract. The evaluation will be performed and delivered to the 

government at the end of each contract year, unless otherwise requested by the Government. 

When a written Program Evaluation is requested, it will be delivered to the Government no later 

than 30 days after the request. The information provided in the evaluation will be per the 

specifics contained in NASA’s request and is limited to the information tracked by the Deloitte 

Safety Representative as defined in this Safety and Health Plan.

Safety and Health Program Performance Documentation

Safety and Health Program Performance documentation for the NNH15526152Q contract effort

will be maintained by Deloitte’s Safety Representative. The documentation will be used to 

measure Deloitte’s effectiveness in meeting safety and health standards, as described in this Plan. 

It will also provide the procedures for the identification, acquisition and processing of Safety and 

Health data and a section where the results of these procedures (metrics) will be collected for 

recordkeeping and statistical analysis. This information will be used to populate the annual

Safety and Health Plan Program Evaluation that will be provided to the COR at the end of each 

contract year. The information that will be collected in this performance documentation includes 

but is not limited to: logs, records, minutes, procedures (e.g. inspections, timeframes, steps, etc.), 

checklists, statistics, reports, data analyses, and other notes/comments. The documentation will 

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 4

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

be made available to NASA in an electronic format, based on Privacy Act requirements. For 

example, full, unimpeded access to the documentation may be made available through a 

protected Shared Drive (within NASA’s firewall) or a NASA SharePoint site.

Deloitte will also provide a roster of terminated employees to the COR no later than 30 days 

after the end of each contract year or at the end of the contract, whichever is applicable. This 

listing will also be provided in an electronic format, as described in the previous paragraph. The 

report will provide the name of any Deloitte employee who worked on a NASA contract during 

the contract year and was terminated from the firm. The following information will be provided 

in the report: date of the report, company name, contract number, name of person terminated, 

social security number, assigned Center badge number, date of termination, and the name/contact 

information of the Deloitte representative who can be contacted for questions regarding the 

termination. The information will be properly encrypted to protect Personally Identifiable 

Information (PII)) prior to the electronic posting of the report.

Deloitte’s Safety and Health Program Performance documentation will also include a hazardous 

communication program proportionate to the nature and hazard of the work environment. The 

documentation will include Safety Data Sheets (SDS) for employees to follow should they 

encounter a situation that may jeopardize their safety and health. These SDS will include 

procedures, escalation steps, and contact information for the appropriate and healthful resolution 

of any risks or issues. 

Material Safety Data

Due to the scope and nature of the NNH15526152Q contract effort, Deloitte does not anticipate 

receiving any materials requiring safety reporting. The NASA Headquarters Safety Officer, will 

be notified prior to any need for Deloitte to receive materials at any of NASA’s facilities.

Hazardous Materials Inventory

Due to the scope and nature of the NNH15526152Q contract effort, Deloitte will not be 

conducting operations that create or involve hazardous materials. Therefore, no procedures have 

been identified for managing hazardous materials. The NASA Headquarters Safety Officer, will 

be notified prior to initiation of the need for Deloitte to manage any hazardous materials at any 

of NASA’s facilities.

Government Access to Safety and Health Program Performance

Documentation

Deloitte’s Safety and Health Program Performance documentation will be made available to 

NASA in an electronic format, based on Privacy Act requirements. For example, full, unimpeded 

access to the documentation may be made available through a protected Shared Drive (within 

NASA’s firewall) or a NASA SharePoint site. The information will be properly encrypted to 

protect Personally Identifiable Information (PII)) prior to the electronic posting of the report.

At any time, NASA can request any additional Safety and Health information through Deloitte’s 

Safety Representative (e.g. relevant personnel records). Every effort will be made to provide this 

additional information to NASA in a timely, and safe/protected manner. 

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 5

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Review and Modification of Safety Requirements

Deloitte will participate in the review and modification of safety requirements as requested by 

NASA and in accordance with established NASA directives and procedures. This includes the 

review of all Safety and Health Plan documentation, including the performance documentation 

and the annual Program Evaluation. The COR can initiate these requests through Deloitte’s 

Safety Representative. 

Procurement

Deloitte will participate in the review and modification of safety requirements for any 

procurements or contractual items under NNH15526152Q contract effort. These requirements 

will be reviewed regularly as described in our Safety and Health Plan Performance 

documentation and will be provided per the instructions in the previous section. At any time, the 

COR can initiate a review of these requirements through Deloitte’s Safety Representative. 

Contractor Relationship with OSHA

It is Deloitte’s responsibility to submit a timely reply to any OSHA citation it receives; Deloitte 

is responsible for settling citations issued against the operation unless specifically addressed in 

the contract.

Plan Update(s)

Deloitte will update this safety and health plan when necessary. Every employee placed under 

the contract will be provided a copy of this safety and health plan. As update(s) to the plan are 

made, each Contractor employee will receive the updated information and new employees will 

be provided a copy of the plan with the current updates incorporated. A copy of the update(s) or 

updated plan can be provided to the NASA Headquarters Safety Officer and the Contracting 

Officer.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 6

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

2. Workplace Analysis

Process

A regular, standardized review of the workplace will be conducted throughout the duration of the 

NNH15526152Q contract effort. The frequency of these reviews will be identified in the Safety 

and Health Program Performance documentation, but will be no less frequently than quarterly. 

Deloitte’s Safety Representative will be responsible for executing the recurring, standard review, 

and documenting the results in the performance documentation. The following are several of the 

methods/techniques that will be used to identify and address potential workplace hazards: 

employee surveys (regularly scheduled and self-initiated), regular inspections conducted by both 

Deloitte’s Safety Representative and/or an appropriate NASA official, investigations of mishaps 

and close calls (standard procedures documented in Deloitte’s Safety and Health Plan 

Performance documentation), the collection of data/metrics for any incidents (e.g. facilityrelated, environmental, etc.), and the reporting of occupational injuries and/or illnesses.

Any hazard identified and/or risk/issue will be documented, evaluated and ranked in accordance 

with NASA Headquarters requirements (complexity and expected exposures).

All hazards on NASA property, which are immediately dangerous to life or health, shall be 

reported immediately to the NASA Headquarters Safety Officer and to Deloitte’s Safety 

Representative and the Program Manager on the NNH15526152Q contract effort. All safety 

engineering products, which address operations, equipment, etc., on NASA Headquarters 

property will be subject to the review and concurrence of the NASA Headquarters Safety 

Officer, unless otherwise specified in the approved safety and health plan. Authorized NASA 

representatives will have access to and the right to examine the sites or areas where work under 

this contract is being performed in order to determine the adequacy of Deloitte’s safety and

health measures in ensuring a safety and healthful working environment to its employees.

Hazard Identification

Hazardous operations, conditions, exposure or other unique hazards do not appear to apply to or 

exist for the scope of work performed under contract NNH15526152Q. For the work performed 

under contract NNH15526152Q at NASA’s facilities, NASA and Deloitte shall jointly decide 

which operations are to be considered hazardous, with NASA as the final authority. Before 

hazardous operations commence, Deloitte shall submit for NASA concurrence (1) written 

hazardous operating procedures for all hazardous operations; and/or (2) qualification standards 

for personnel involved in hazardous operations.

Inspections

The Deloitte Safety Representative for contract NNH15526152Q will periodically, but no less 

frequently than quarterly, inspect the NASA work area where work related to contract 

NNH15526152Q is being performed for safety and health risks. If applicable and required, 

written record of the inspection and/or evaluation records can be collected, along with corrective 

measures and provided to the NASA Headquarters Safety Officer, no later than 5 working days 

after completion of the inspection/evaluation.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 7

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

This process has been successfully executed for the previous 10 years at NASA Headquarters, as 

part of the previous two BASO BPAs. Deloitte’s Safety Representative for these two contracts 

(the Partner in charge of the project) performed floor checks, interviews with employees and 

regular meetings to assess safety and health standards and practices. Updates were identified and 

incorporated into the onboarding document, and the COR was provided with major updates, as 

required.

Employee Reports of Hazards

Deloitte employees will be provided with the guidance and templates to report any potential 

safety or health hazard, in writing, to their Supervisor, the NASA HQ Safety and Occupational 

Health Office, the NASA Mishap Information System (NMIS) (as required), and the Deloitte 

Safety Representative.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 8

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

3. Mishap Investigation and Record Analysis

Mishap Investigation

For the work performed under contract NNH15526152Q at NASA’s facilities, Deloitte shall 

cooperate with NASA during the investigation of all work-related mishaps, incidents, and close 

calls, to the extent necessary to determine their causes and provide the Contracting Officer and 

the NASA Headquarters Safety Officer, a report of the investigative findings and proposed or 

completed corrective actions.

Mishap Reporting

Notification/Reporting Procedures

For the work performed under contract NNH15526152Q at NASA’s facilities, Deloitte shall 

immediately notify and promptly report to the Contracting Officer and to the NASA HQ Safety 

Office any Type A, Type B, or Type C mishaps that involve a lost time injury or illness. Deloitte 

shall also notify OSHA within 8 hours of a work-related fatality. All Type C mishaps that do not 

involve a lost time injury or illness, Type D and low-visibility incidents shall be reported to the 

NASA HQ Safety Office within 4 hours of initiating the emergency response. Deloitte 

notifications shall be made via the Safety Hotline (202) 358-HELP (4357) or NASA’s electronic 

Incident Reporting Information System (ISRS).

Deloitte is not required to include in any report an expression of opinion as to the fault or 

negligence of any employee. In addition, service Contractors (excluding construction contracts) 

shall provide monthly reports specifying exposure hours, lost-time frequency rate, number of 

lost-time injuries, and accident/incident dollar losses as specified in the contract Schedule and 

not later than the 7th day of the month following the reporting month.

NASA Mishap Reporting Categorizations

All Contractor mishap reports will be reported to the NASA Headquarters Safety Officer, using 

NASA coding of incidents in accordance with the following specified classifications:

• Type A Mishap. A mishap resulting in one or more of the following: (1) an occupational 

injury or illness resulting in a fatality or a permanent total disability, (2) a total direct cost 

of mission failure and property damage equal to or greater than $2,000,000; (3) a crewed 

aircraft hull loss; (4) unexpected crewed aircraft departure from controlled flight (except 

high performance jet/test aircraft such as F-15, F-16, F/A-18, T-38, OV-10, and T-34, 

when engaged in flight test activities).

• Type B Mishap. A mishap that caused an occupational injury or illness that resulted in a 

permanent partial disability or hospitalization for inpatient care of 3 or more people 

within 30 workdays of the mishap, or a total direct cost of mission failure and property 

damage equal to or greater than $500,000 but less than $2,000,000.

• Type C Mishap. A mishap resulting in a nonfatal occupational injury or illness that 

resulted in days away from work, not including the day or shift on which it occurred, or 

restricted work or transfer to another job not including the day or shift on which it 

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 9

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

occurred, or hospitalization for inpatient for inpatient care of one or two people within 30 

workdays of the mishap, or a total direct cost of mission failure and property damage 

equal to or greater than $50,000 but less than $500,000.

• Type D Mishap. A mishap that caused any nonfatal OSHA recordable occupational 

injury and/or illness that does not meet the definition of a Type C mishap, or a total direct 

cost of mission failure and property damage equal to or greater than $20,000 but less 

$50,000.

• Mission Failure. A mishap of whatever intrinsic severity that prevents the achievement 

of the mission’s minimum success criteria or minimum mission objectives as described in 

the mission operations report or equivalent document.

• Close Call. An event in which there is no injury or only minor injury requiring first aid 

and/or no equipment or property damage, or minor equipment or property damage of less 

than $20,000, or not injury or only minor injury requiring first aid, but which possesses a 

potential to cause a mishap.

Trend Analysis

Deloitte’s Safety Representative will perform regular trend analysis of the data/metrics gathered 

as a part of the Safety and Health Plan Performance documentation. The data that will be 

analyzed includes, but is not limited to: occupational injuries and illnesses; facilities, systems, 

and equipment performance; maintenance findings; mishap reporting; and safety and health 

risks/issues/findings. The metrics will be summarized into a table that will include a historical 

view of the data, actions performed to reduce the likelihood of recurrence, targets for future 

metrics, and next steps (as appropriate). The Trend Analysis will be included a part of the Safety 

and Health Plan Performance documentation, which will be made available to all employees on 

the contract and NASA in an electronic format, based on Privacy Act requirements. For example, 

full, unimpeded access to the documentation may be made available through a protected Shared 

Drive (within NASA’s firewall) or a NASA SharePoint site. The information will be properly 

encrypted to protect Personally Identifiable Information (PII)) prior to the electronic posting of 

the report.

Accident/Incident Summary Report

As mishaps and/or incidents occur under contract NNH15526152Q, Deloitte will provide the 

NASA Headquarters Safety Officer a monthly summary of all mishaps and incidences to include 

lost-time frequency rate, number of lost-time injuries, exposure, and mishap/incident dollar 

losses, trend analysis, and corrective actions by the 7th day of the month following each month 

reported. Negative reports will also be provided.

Log of Occupational Injuries and Illnesses

As mishaps and/or incidents occur under contract NNH15526152Q, Deloitte shall deliver to the 

NASA Headquarters Safety Officer, and the Contracting Officer, (under separate Contractor's 

cover letter), a copy of the annual summary of occupational injuries and illnesses (or equivalent) 

as described in Title 29, Code of Federal Regulations, Subpart 1904.32 or equivalent data. This 

report shall only include occupational injuries or illnesses that occurred under contract 

NNH15526152Q at NASA’s facilities. This report will be reported by calendar year and 

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 10

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

provided to the NASA Headquarters Safety Officer, within 45 days after the end of the year to be 

reported, but not later than February 15 of the year following. A soft copy of the report will be 

made available via email, and a hard copy of the report can be provided upon request.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 11

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

4. Hazard Prevention and Control

Hazard Prevention

Deloitte recognizes that even though there is no expectation of exposure to toxic or unhealthful 

materials through the execution of the NNH15526152Q contract effort, there still remains the 

need to perform proactive hazard prevention to help minimize common mishaps, such as slips, 

trips, falls, ergonomic issues, and electrical and indoor air quality concerns. As described in 

section 2. Workplace Analysis, the Deloitte Safety Representative for contract NNH15526152Q

will periodically (but no less frequently than quarterly) inspect the NASA work area where work 

related to contract NNH15526152Q is being performed for safety and health risks. Findings will 

be documented in the Safety and Health Plan Performance documentation described in section 1. 

Management Leadership and Employee Participation, and metrics will be captured and reported 

as described in the Trend Analysis part of section 3. Mishap Investigation and Record Analysis. 

Updates and improvements to the Safety and Health Plan and Procedures will be identified and 

implemented as needed (based on the findings from the regular inspections). These updates and 

improvements will be reviewed regularly to determine if the recurrence of the risk/issue is 

reducing, demonstrating the successful completion of the update/improvement.

As stated above, the documentation, results from the annual reports, and the metrics/trend 

analysis will be made available to all employees on the contract and NASA in an electronic 

format, based on Privacy Act requirements.

Appropriate Controls

The Deloitte Safety Representative will perform an inspection of Deloitte’s work area within 30 

days of contract award to identify the appropriate controls that apply to the workplace and 

environment. These controls will be validated with the COR and documented in the Safety and 

Health Plan Performance documentation, described in previous sections. These controls will be 

reviewed periodically (at the same time as the regular inspections) and the controls will be 

amended and/or updated as necessary. 

Deloitte will follow NASA’s Hazard Reduction Precedence Sequence methodology to assess and 

accept residual risk. This involves an evaluation of the Likelihood and Severity of each risk as it 

relates to the following six elements: (1) Eliminate risk through design, (2) Substitute less risky 

materials for more hazardous materials, (3) Install safety devices, (4) Install caution and warning 

devices, (5) Develop administrative controls, and (6) Provide protective clothing and equipment. 

Assessing each risk against these variables will help determine the appropriate mitigation 

strategies and the precedence with which each risk needs to be addressed.

The controls established and managed will be consistent with the work performed under the 

NNH15526152Q contract effort, and will focus on workplace environment safety and health 

standards. Deloitte does not anticipate dealing with hazardous chemicals, equipment, discharges, 

waste or energies as part of the NNH15526152Q contract effort. If the need arises to discuss any 

of the controls identified, or if any unexpected safety and health items apply to the contract, the 

Deloitte Safety Representative will coordinate with the appropriate safety, health, environmental 

service and emergency authorities at NASA.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 12

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Hazardous Operations

No hazardous operations apply to the scope of work performed under contract NNH15526152Q;

therefore Deloitte does not expect any hazardous operations to be conducted. The following are 

examples of hazardous operations: electrical work, chemical usage, mechanical activities, 

pressure-related functions, noise handling, gravity-based functions, activities involving radiation, 

bio-mechanical activities and microbiological activities. If any of these operations (or any other 

operations deemed to be hazardous by the Deloitte Safety Representative) are included in a 

future task as part of the NNH15526152Q contract effort, Deloitte’s Safety Representative will 

notify the NASA safety office within 5 days of assuming the operations of any concerns, as well 

as our approach and controls for handing and executing these operations.

Written Procedures

All written procedures for Deloitte’s Safety and Health Plan, including the process for 

identifying, documenting and executing controls for hazardous operations will be included in the 

Safety and Health Plan Performance documentation, described in section 1. Management 

Leadership and Employee Participation. The documentation will also contain inspection 

procedures, test procedures and other relevant information related to each control, so they can be 

reviewed, tested, and updated in accordance with regular inspections/reviews. 

As stated above, the documentation, controls, and procedures will be made available to all 

employees on the contract and NASA in an electronic format, based on Privacy Act 

requirements.

Protective Equipment

No hazardous operations apply to the scope of work performed under contract NNH15526152Q;

therefore no procedures have been created for obtaining, inspecting, and maintaining protective 

equipment are identified.

Hazardous Operations Permits

No hazardous operations apply to the scope of work performed under contract NNH15526152Q;

therefore hazardous operations permits will not be required.

Operations Involving Potential Asbestos Exposures

Due to the scope and nature of the NNH15526152Q contract effort, Deloitte staff will not be 

exposed to asbestos. Therefore, no procedures have been identified for ensuring compliance with 

the Asbestos Control Program. The NASA Headquarters Safety Officer will be notified prior to 

initiation of any potential asbestos operations conducted at any of NASA’s facilities by Deloitte.

Operations Involving Exposures to Toxic or Unhealthful Materials

Due to the scope and nature of the NNH15526152Q contract effort, Deloitte staff will not be 

exposed to toxic or healthful materials. The NASA Occupational Health Office and Headquarters 

Safety Officer will be notified prior to initiation of any new/modified operations potentially 

hazardous to health and safety at any of NASA’s facilities by Deloitte.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 13

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

Operations Involving Hazardous Waste

Due to the scope and nature of the NNH15526152Q contract effort, Deloitte will not be 

conducting operations that create or involve hazardous waste. Therefore, no procedures have 

been identified for managing hazardous waste. The NASA Headquarters Safety Officer will be 

notified prior to initiation of any hazardous waste operation conducted at any of NASA’s 

facilities by Deloitte. Also, if a hazardous waste operation were to be initiated, Deloitte will 

provide a copy of any waste removal agreements and proof of destruction to the NASA 

Headquarters Safety Officer.

Operations Involving New or Modified Emissions/Discharges to the Environment

Due to the scope and nature of the NNH15526152Q contract effort, Deloitte operations will not 

create new emissions/discharges to the Environment. Therefore, no procedures have been 

identified for monitoring emissions/discharges and reporting findings/results.

Baseline Documentation

No hazardous operations apply to the scope of work performed under contract NNH15526152Q;

therefore no procedures for maintaining facility baseline documentation are identified.

Preventive Maintenance

No hazardous operations apply to the scope of work performed under contract NNH15526152Q;

therefore no preventative maintenance methods are identified.

Medical Program

Due to the scope and nature of the NNH15526152Q contract effort, Deloitte does not appear to 

have a requirement for a medical surveillance program. Therefore, no specifics have been 

identified for evaluating personnel and workplace conditions or use of occupational health 

professional’s services.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 14

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

5. Emergency Response

Emergency Preparedness

Deloitte employees located in the NASA Headquarters Building, will comply with and 

participate in NASA Headquarters established procedures for emergency preparedness drills and 

evacuations. Also, in the event that Deloitte employees are on travel to the various NASA 

centers during such drills, compliance and participation will similarly occur. Additionally, the 

Deloitte Safety Representative will discuss NASA’s Emergency Notification system with any 

new employees and encourage participation in the program.

Fire Prevention

The Deloitte Safety Representative will participate as necessary in NASA Headquarters fire 

safety program including coordination of related issues with NASA facility managers and 

emergency planning and response officials and their representatives. Deloitte employees will be 

instructed to report a fire or to pull the alarm for a fire; Deloitte employees will not attempt to 

extinguish the fire.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 15

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

6. Safety and Health Training

Training

Deloitte is responsible for all safety and health training required by NASA for Deloitte 

employees. Deloitte employees and contracted individuals should be informed of this health and 

safety plan, their responsibilities under the plan, and the method by which they should report 

perceived unsafe or unhealthy working conditions. Employees are also to be informed and aware 

of medical attention and physical examinations to which they may be entitled by virtue of their 

employment by their respective company.

Periodic training may be required and provided to those Deloitte contracted employees in 

positions that expose them to potentially unsafe working conditions on a regular basis. Health 

and safety information should be provided periodically to all employees, including information 

about personal health and hygiene. 

Deloitte’s Safety Representative will be responsible for notifying new employees of training 

requirements (both the requirements by Deloitte and by NASA), and validating all employees 

have taken the appropriate training courses/reviewed the appropriate documentation. The Safety 

Representative is also responsible for the records maintenance, which will be incorporated into 

the Safety and Health Plan Performance documentation, and available for review by all 

employees and NASA personnel.

Certification

As applicable and required, Deloitte will provide certification and recertification training so that 

its employees are qualified to perform their tasks through specific training, experience, or 

combination of both.

Training Documentation and Verification

As applicable and required, Deloitte will document safety and safety-related training in 

accordance with OSHA requirements. Upon request, all training materials and training records 

will be provided to the NASA Headquarters Safety Officer, for review.

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 16

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.
National Aeronautics and Space Administration (NASA)

Business and Administrative Systems Office (BASO)

Volume I - Offer Volume - Appendix A

7. References

Deloitte will comply with the most current version of all required safety and safety-related 

standards, directives, policy and guidance material:

• Public Law 91-596, Occupational Safety and Health Act of 1970

• Title 29 Code of Federal Regulations Part 1904

• Title 29 Code of Federal Regulations Part 1910

• Title 29 Code of Federal Regulations Part 1910.1200, Hazard Communication

• Title 29 Code of Federal Regulations Part 1926

• Title 29 Code of Federal Regulations Part 1960

• Federal STD 313, Material Safety Data Sheets

• OSHA Publication 3088, How to Prepare for Worksite Emergencies

• Engineer Manual 385-1-1, U.S. Army Corps of Engineers, Safety and Health 

Requirements

• NPR 8621.1, NASA Procedural Requirements for Mishap and Close Call Reporting, 

Investigating, and Recordkeeping

• HQPR 8621.1 Mishap Reporting, Investigating, and Recordkeeping Program and Plan

• NPD 8710.1D, Emergency Management Program

• HQPR 8710.1 The NASA Headquarters (HQ) Emergency Preparedness Plan (EPP)

• NPR 8715.1A, NASA Occupational Safety and Health Programs

• NPR 8715.2B, NASA Emergency Management Program Procedural Requirements 

• NPR 8715.3C, NASA General Safety Program Requirements

• NASA Headquarters Emergency Occupancy Plan

Request for Quotation (RFQ): NNH15526152Q March 18, 2015 17

Use or disclosure of the data contained on this page is subject to the restrictions on the title page of this proposal.