NASA Procedural Requirements

NPR 8000.4C Effective Date: April 19, 2022 Expiration Date: April 19, 2027

Subject: Agency Risk Management Procedural Requirements

Responsible Office: Office of Safety and Mission Assurance

Table of Contents

Preface

P.1 Purpose
P.2 Applicability
P.3 Authority
P.4 Applicable Documents and Forms
P.5 Measurement/Verification
P.6 Cancellation

Chapter 1. Introduction

1.1 Background
1.2 RISK Management within the NASA Hierarchy

Chapter 2. Roles and Responsibilities

2.1 General 2.2 Organizational Roles and Responsibilities
2.3 Individual Accountabilities for RISK Acceptance

Chapter 3. Requirements for RISK Management

3.1 General
3.2 General RISK Management Requirements
3.3 Requirements for the RIDM Process
3.4 Requirements for the CRM Process
3.5 Requirements for Programmatic Decisions to Accept RISKs to Safety, Mission Success, Physical Security, or Cybersecurity
3.6 Requirements for Decisions to Accept Institutional RISKs to Safety or Mission Success
3.7 Requirements for Decisions to Accept RISKs to Safety and Mission Success Affecting Both Programmatic and Institutional Organizational Units

Appendix A. Definitions
Appendix B. Acronyms
Appendix C. Technical Notes on Physical Security and Cybersecurity RISK Management
Appendix D. Procurement/Contract RISK Management
Appendix E. References

DISTRIBUTION:
NODIS

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.