Subject: NASA Information Technology Program and Project Management Requirements (Revalidated with Change 1)

Responsible Office: Office of the Chief Information Officer

Preface

P.1 Purpose

This document establishes the requirements by which NASA formulates and executes Information Technology (IT) service lines and projects as prescribed in NPD 7120.4, NASA Engineering and Program/Project Management Policy, and consistent with NPD 1000.3, The NASA Organization.

P.2 Applicability

a. This NASA Procedural Requirement (NPR) is applicable to NASA Headquarters and NASA Centers, including Component Facilities and Technical and Service Support Centers. This NPR applies to other contractors, recipients of grants, cooperative agreements, or other agreements only to the extent specified or referenced in the applicable contracts, grants, or agreements.

b. This NPR applies to service line and project management for all NASA IT service lines and all IT projects within an IT service line or within a non-IT program to ensure compliance with requirements and authority defined in NPD 7120.4. IT projects do not include IT incorporated within space flight, space technology, or aeronautics research projects. IT incorporated within space technology projects are governed by NPR 7120.5, NASA Space Flight Program and Project Management Requirements. IT incorporated within space flight research projects and aeronautics research projects are governed by NPR 7120.8, NASA Research and Technology Program and Project Management Requirements. The requirements of this NPR are considered to be the minimum requirements for all efforts within NASA IT service lines and IT projects; however, more stringent requirements can be added for specific IT service lines or IT project efforts.

c. In this directive, all mandatory actions (i.e., requirements) are denoted by statements containing the term "shall." The terms: "may" or "can" denote discretionary privilege or permission, "should" denotes a good practice and is recommended, but not required, "will" denotes expected outcome, and "are/is" denotes descriptive material.

d. In this directive, all document citations are assumed to be the latest version, unless otherwise noted.

P.3 Authorities

a. NPD 2800.1, Managing Information Technology.

b. NPD 7120.4, NASA Engineering and Program/Project Management Policy.

P.4 Applicable Documents and Forms

a. NPD 1000.3, The NASA Organization.

b. NPD 1000.5, Policy for NASA Acquisition.

c. NPD 1200.1, NASA Internal Control.

d. NPD 2800.1, Managing Information Technology.

e. NPD 2810.1, NASA Information Security Policy.

f. NPD 9250.1, Capital Asset Identification and Treatment.

g. NPR 1382.1, NASA Privacy Procedural Requirements.

h. NPD 1440.6, NASA Records Management.

i. NPR 1441.1, NASA Records Management Program Requirements.

j. NPR 2800.2, Information and Communication Technology Accessibility.

k. NPR 2810.1, Security of Information and Information Systems.

l. NPR 2830.1, NASA Enterprise Architecture Procedures.

m. NPR 7150.2, NASA Software Engineering Requirements.

n. NPR 8000.4, Agency Risk Management Procedural Requirements.

o. NAII 2800.1, NASA Advisory Implementing Instructions: NASA Paperwork Reduction Act (PRA) Compliance Program, NASA Paperwork Reduction Act (PRA) Compliance Program.

p. NASA/SP-2016-3076, NASA Standing Review Board Handbook.

q. NASA OCIO/SP-2020-0002, IT Program/Project Management Handbook.

r. NASA OCIO/SP-2018-0001, Office of the Chief Information Officer (OCIO) Risk Management Plan.

s. Federal Information Processing Standards (FIPS) 199, Federal Information Processing Standard for Security Categorization of Federal Information and Information Systems.

t. Office of Federal Procurement Policy (OFPP) Memorandum, Revisions to the Federal Acquisition Certification for Program and Project Managers (FAC-P/PM), December 2013.

u. National Institute of Standards and Technology (NIST) Special Publication 800-160 Volume 1, Engineering Trustworthy Secure Systems, November 16, 2022.

v. National Institute of Standards and Technology (NIST) Special Publication 800-160 Volume 2, Developing Cyber-Resilient Systems: A Systems Security Engineering Approach, December 9, 2021.

P.5 Measurement/Verification

a. The Key Decision Points (KDPs) and project Systems Engineering (SE) reviews measure and verify that the service lines and projects have submitted products and control plans due at the reviews, that the products and control plans meet published exit criteria and maturity levels, and that the service lines and projects are performing within acceptable variances for scope/technical, cost, and schedule objectives.

b. The Deputy Service Line Director or Project Manager shall store required documentation, including the approved Compliance Matrix (see Appendix C) in a records repository accessible by the Agency OCIO.

P.6 Cancellation

a. NPR 7120.7, NASA Information Technology and Institutional Infrastructure Program and Project Management Requirements, dated November 3, 2008.

b. NASA Interim Directive (NID) 7120.99, NASA Information Technology and Institutional Infrastructure Program and Project Management Requirements, dated December 22, 2011.

DISTRIBUTION:
NODIS

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.