[Federal Register Volume 67, Number 144 (Friday, July 26, 2002)]
[Rules and Regulations]
[Pages 48814-48815]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-19004]
=======================================================================
-----------------------------------------------------------------------
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
48 CFR Parts 1804 and 1852
Security Requirements for Unclassified Information Technology
Resources
AGENCY: National Aeronautics and Space Administration (NASA).
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This final rule adopts with changes the interim rule published
in the Federal Register on July 12, 2001. The interim rule amended the
NASA FAR Supplement (NFS) to clarify information technology (IT)
security requirements for sensitive information contained in
unclassified automated information resources
EFFECTIVE DATE: July 26, 2002.
FOR FURTHER INFORMATION CONTACT: Karl Beisel, NASA Headquarters, Code
HC, Washington, DC 20546, (202) 358-0416, [email protected].
SUPPLEMENTARY INFORMATION:
A. Background
NASA published an interim rule in the Federal Register at 66 FR
36490 on July 12, 2001, revising NFS section 1804.470 and the clause at
1852.204-76, Security Requirements for Unclassified Information
Technology Resources. These sections address security requirements for
unclassified IT resources. The action implemented The Computer Security
Act of 1987 and Appendix III of the Office of Management and Budget
(OMB) Circular No. A-130, Security of Federal Automated Information
Resources, which require adequate security be provided for all Agency
information collected, processed, transmitted, stored, or disseminated.
NFS section 1804.470 contains the requirement for all NASA contractors
and subcontractors to comply with Federal and NASA policies in
safeguarding unclassified NASA data held via information technology
(IT).
Public comments were received from one source. The comments were
considered in developing this final rule.
Changes are made in this final rule to section 1804.470-1, Scope,
to reference Federal policies that are implemented through NASA's
Procedures and Guidelines (NPG) 2810.1, Security of Information
Technology, and amend paragraph (d)(3)(i) of the clause at 1852.204-76
to remove the exemption of certain information contained in Standard
Form 85P, Questionnaire for Public Trust Positions.
NASA understands that the FAR Council is working with the OMB
[[Page 48815]]
Committee on Executive Branch Information Systems Security under the
President's Critical Infrastructure Protection Board on the development
of a government-wide IT security clause. The purpose of this work is to
ensure that IT security requirements are included in all applicable
Federal government contracts. Upon completion of this government-wide
effort, NASA will modify its rule, as may be necessary, to ensure
consistency with the FAR coverage.
This is not a significant regulatory action, and therefore, was not
subject to review under Section 6(b) of Executive Order 12866,
Regulatory Planning and Review, dated September 30, 1993. This rule is
not a major rule under 5 U.S.C. 804
B. Regulatory Flexibility Act
NASA certifies that this rule will not have a significant economic
impact on a substantial number of small entities within the meaning of
the Regulatory Flexibility Act (5 U.S.C. 601 et seq.), because this
rule only clarifies existing requirements and does not impose any new
requirements.
C. Paperwork Reduction Act
This rule clarifies existing requirements that were previously
approved by the Office of Management and Budget (OMB) under OMB Control
No. 2700-0098.
List of Subjects in 48 CFR Parts 1804 and 1852
Government Procurement.
Tom Luedtke,
Assistant Administrator for Procurement.
Interim Rule Adopted as Final With Change
Accordingly, the interim rule amending 48 CFR parts 1804 and 1852,
published at 66 FR 36492 on July 12, 2001, is adopted as final with the
following changes:
1. The authority citation for 48 CFR parts 1804 and 1852 continues
to read as follows:
Authority: 42 U.S.C. 2473(c)(1).
PART 1804--ADMINISTRATIVE MATTERS
2. Revise section 1804.470-1 to read as follows:
1804.470-1 Scope.
This section implements NASA's acquisition-related aspects of
Federal policies for assuring the security of unclassified automated
information resources. Federal policies include, but are not limited
to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.), the
Clinger-Cohen Act of 1996 (40 U.S.C. 1401 et seq.), Public Law 106-398,
section 1061, Government Information Security Reform, OMB Circular A-
130, Management of Federal Information Resources, and the National
Institute of Standards and Technology security guidance and standards.
PART 1852--SOLICITATION PROVISIONS AND CONTRACT CLAUSES
1852.204-76 [Amended]
3. Amend section 1852.204-76 in the clause heading by removing
``(JULY 2001)'' and adding ``(July 2002)'' in its place; and in
paragraph (d)(3)(i) by removing ``(Information regarding financial
record, question 22, and the Authorization for Release of Medical
Information are not applicable)''.
[FR Doc. 02-19004 Filed 7-25-02; 8:45 am]
BILLING CODE 7510-01-P