Information that is determined by a designated NASA
official to be unusually sensitive (refer to paragraph
5.22.5. for decontrol provisions). The following are
examples of such information.
(1) Predecisional materials such as national space policy
not yet publicly released, pending reorganization plans, or
sensitive travel itineraries
(2) Geological and geophysical information and data,
including maps, concerning wells.
(3) Center maps and/or plain text documents describing
locations/directions (e.g., latitude, longitude, depth,
etc.) of underground utility conduits (e.g., sewers, gas,
data, communications, etc.).
(4) Drawings and specifications that identify existing or
proposed security measures for mission essential
infrastructure designated assets or other key resources
(5) Mission specific security plans that identify
protective measures and procedures for assets that are
sensitive in nature but are not classified. (Example:
Payloads that utilize special nuclear materials, payloads
that contain certain animal experiments, and STS missions,
as determined by the CCS, etc.)
(6) Emergency contingency or continuity of operations plans
that provide detailed information regarding emergency
response processes and procedures that, if publicized,
could give a potential adversary vital information with
which to thwart or compromise emergency response efforts.
(7) Sensitive scientific and technical information (STI)
(See NPD 2200.1 and NPR 2200.2 for requirements for
documentation, approval, and dissemination of NASA STI).
(8) Information that could result in physical risk to
personnel.
(9) NASA information technology (IT) internal systems data
revealing infrastructure used for servers, desktops, and
networks; applications name, version and release;
switching, router, and gateway information;
interconnections and access methods; mission or business
use/need. Examples of information are systems inventories
and enterprise architecture models.
(10) Systems security data revealing the security posture
of the system. For example, threat assessments, system
security plans, contingency plans, risk management plans,
Business Impact Analysis studies, and Certification and
Accreditation documentation.
(11) Reviews or reports illustrating or disclosing facility
infrastructure or security vulnerabilities, whether to
persons, systems, or facilities, not otherwise eligible for
classification under Executive Order 12958, as amended.
(12) Information that could constitute an indicator of U.S.
government intentions, capabilities, operations, or
activities or otherwise threaten operations security.
(13) Developing or current technology, the release of which
could hinder the objectives of NASA, compromise a
technological advantage or countermeasure, cause a denial
of service, or provide an adversary with sufficient
information to clone, counterfeit, or circumvent a process
or system.