NASA Procedural Requirements

NPR 7120.7A Effective Date: August 17, 2020 Expiration Date: August 17, 2030

Subject: NASA Information Technology Program and Project Management Requirements (Revalidated with Change 1)

Responsible Office: Office of the Chief Information Officer

Appendix C. Compliance Matrices

C.1 The full Compliance Matrix provides a list of requirements to document service line and project compliance with this NPR.

C.2 The tailoring for requirements is documented in the Compliance Matrix.

C.3 Service Line Deputy Directors or Project Managers must obtain written approval from the OCIO requirements owner to tailor any IT policy requirement and annotate the name of the requirement owner and the date of their approval in the Justification column of the preliminary Compliance Matrix.

C.4 Service Line Deputy Directors or Project Managers attach the preliminary Compliance Matrix to the Organizational Summary (for service lines) or Formulation Authorization Document (for projects) and the final Compliance Matrix to the Service Line Plan (for service lines) or Project Plan (for projects).

C.5 Once the Organizational Summary or FAD is signed and the Compliance Matrix has been briefed and approved by the DA, the tailoring is considered approved, through KDP-1 (for service lines) or KDP-Implementation (for projects).

C.6 Once the Service Line Plan or Project Plan is signed and the final Compliance Matrix has been briefed and approved by the DA, the tailoring is considered approved through service line or project completion. The Service Line Deputy Director or Project Manager attaches a final version of the Compliance Matrix to the Servcie Line Plan or Project Plan, which is presented and approved at KDP-1 (for service lines) or KDP-Implementation (for projects) and included as part of the scope baseline.

C.7 If updates to the matrix are needed after it has been approved, then the Service Line Deputy Director or Project Manager includes the updates in the respective Service Line Plan or Project Plan for approval at a KDP or rebaseline review.

C.8 The Compliance Matrix is completed in accordance with these instructions. The matrix lists the following:

C.8.1 NPR 7120.7 requirement statement.

C.8.2 Product state.

C.8.3 NPR 7120.7 paragraph reference.

C.8.4 "Compliance" column to describe the level of compliance and identify the approach to the requirement.

C.8.4.1 "C" for Comply - requirement is met without tailoring and within the specified phase.

C.8.4.2 "PC" for Partially Comply - requirement is partially met within the annotated phase; requirement is partially met outside the annotated phase; or requirement is fully met outside of the annotated phase.

C.8.4.3 "NC" for Not Comply - requirement will not be met.

C.8.4.4 "NA" for Not Applicable - requirement does not apply.

C.8.5 "Justification" column to describe the rationale for tailoring, why and how the requirement will be tailored, justification for why the requirement is not applicable, and the name and date for the approving requirement owner.

C.8.5.1 It is expected that much of the rationale listed as justification will already have been developed in retrievable service line and/or project records (e.g., FAD or other documentation) and can be referenced easily.

C.8.5.2 In the case where evaluation of the justification indicates that the tailoring of a requirement increases risk, the risk will be carried in service line or project risk register.

C.7 IT Policy Requirements

Table C-1. IT Service Line and Project Policy Requirements

C.8 IT Service Line Requirements

Table C-2. IT Service Line: Formulation Phase (Phase 0)

Table C-3. IT Service Line: Implementation/Operations Phase (Phase 1-n)

C.9 IT Project Requirements

Table C-4. IT Pre-Formulation Phase

Table C-5. IT Formulation Phase

Table C-6, IT Implementation Phase

Table C-7. IT Operations Phase

Table C-8. IT Decommission Phase

Table C-9. Any Phase

DISTRIBUTION:
NODIS

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.