NASA Information Security Protection, 5116-5122 [2013-00532]

Agencies

• National Aeronautics and Space Administration

[Federal Register Volume 78, Number 16 (Thursday, January 24, 2013)]
[Rules and Regulations]
[Pages 5116-5122]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-00532]


=======================================================================
-----------------------------------------------------------------------

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

14 CFR Part 1203

[Document No. NASA-2012-0006]
RIN 2700-AD61


NASA Information Security Protection

AGENCY: National Aeronautics and Space Administration.

ACTION: Direct final rule.

-----------------------------------------------------------------------

SUMMARY: This direct final rule makes nonsubstantive changes to align 
with and implement the provisions of Executive Order (E.O.) 13526, 
Classified National Security Information, and appropriately to 
correspond with NASA's internal requirements, NPR 1600.2, Classified 
National Security Information, that establishes the Agency's 
requirements for the proper implementation and management of a uniform 
system for classifying, accounting, safeguarding, and declassifying 
national security information generated by or in the possession of 
NASA. The revisions to these rules are part of NASA's retrospective 
plan under E.O. 13563 completed in August 2011. NASA's full plan can be 
accessed on the Agency's open Government Web site at https://www.nasa.gov/open/.

DATES: This direct final rule is effective on March 25, 2013. Comments 
due on or before February 25, 2013. If adverse comments are received, 
NASA will publish a timely withdrawal of the rule in the Federal 
Register.

ADDRESSES: Comments must be identified with RINs 2700-AD61 and may be 
sent to NASA via the Federal E-Rulemaking Portal: https://www.regulations.gov. Follow the online instructions for submitting 
comments. Please note that NASA will post all comments on the Internet 
with changes, including any personal information provided.

FOR FURTHER INFORMATION CONTACT: Steve Peyton, 202-358-0191, 
steven.l.peyton@nasa.gov.

SUPPLEMENTARY INFORMATION: 

Background

    In accordance with E.O. 13526, Classified National Security 
Information, 32 CFR part 2001, Information Security Oversight Office 
(ISOO) Classified National Security Information Final Rule Implementing 
Directive, E.O. 12968, Access to Classified Information, E.O. 13549, 
Classified National Security Information Programs for State, Local, 
Tribal and Private Sector Entities, E.O. 12829, National Industrial 
Security Program, and 51 U. S. C., 20132 and 20133, National and 
Commercial Space Program, the President and the NASA Administrator 
establish security requirements, restrictions, and safeguards for NASA 
information in the interest of national security.
    Part 1203 is the foundation for establishing NASA's information 
security program implementation requirements. It prescribes security 
and protective services requirements for NASA Headquarters, NASA 
Centers, and component facilities in order to protect the Agency's 
employees, contractors, property, and information. Therefore, it is 
being amended to comply with the Order and the Implementing Directive 
and to clarify the requirements for establishing an Information 
Security Program and handling National Security Information.
    Additional provisions of part 1203 are implemented in NASA 
Procedural Requirements (NPR) 1600.2, NASA Classified National Security 
Information, to further ensure compliance. NPR 1600.2 can be accessed 
at https://nodis3.gsfc.nasa.gov/displayDir.cfm?t=NPR&c=1600&s=2.

Direct Final Rule and Significant Adverse Comments

    NASA has determined this rulemaking meets the criteria for a direct 
final rule because it involves clarifications, updating, and 
nonsubstantive changes to existing regulations. NASA does not 
anticipate this direct final rule will result in major changes to its 
security procedures. However, if NASA receives significant adverse 
comments, NASA will withdraw this final rule by publishing a note in 
the Federal Register in order to revisit the commented-on language. In 
determining whether a comment necessitates withdrawal of this final 
rule, NASA will consider whether it warrants a substantive response in 
a notice and comment process.

Statutory Authority

    Section 1203 is established under E.O. 13526, 32 CFR parts 2001 and 
2003, the Implementing Directive, E.O. 12968 as amended, Access to 
Classified Information, E.O. 13549, Classified National Security 
Information Programs for State, Local, Tribal and Private Sector 
Entities, E.O. 12829, National Industrial Security Program, and The 
Space Act, in accordance with 51 U.S.C., National and Commercial Space 
Program. Sections 20132 and 20133 authorize the NASA Administrator to 
establish security rules and procedures to handle and safeguard 
Classified National Security Information. The rules serve to achieve 
compliance with the Administator's objectives for the protection of 
NASA's personnel, property, and information.

Regulatory Analysis

Executive Order 12866, Regulatory Planning and Review and Executive 
Order 13563, Improving Regulation and Regulation Review

    Executive Orders 13563 and 12866 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). Executive 
Order 13563 emphasizes the importance of quantifying both costs and 
benefits, of reducing costs, of harmonizing rules, and of promoting 
flexibility. This rule has been designated as ``administrative'' under 
section 3(f) of Executive Order 12866. Accordingly, the rule has been 
reviewed by the Office of Management and Budget.

Review Under the Regulatory Flexibility Act

    The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires an 
agency to prepare an initial regulatory flexibility analysis to be 
published at the time the proposed rule is published. This requirement 
does not apply if the agency ``certifies that the rule will not, if 
promulgated, have a significant economic impact on a substantial number 
of small entities'' (5 U.S.C. 603). This rule does not have a 
significant economic impact on a substantial number of small entities.

Review Under the Paperwork Reduction Act

    This direct final rule does not contain any information collection 
requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 
3501 et seq.).

Review Under Executive Order of 13132

    E.O. 13132, ``Federalism,'' 64 FR 43255 (August 4, 1999) requires 
regulations be reviewed for Federalism effects on the institutional 
interest of states and local governments, and, if the

[[Page 5117]]

effects are sufficiently substantial, preparation of the Federal 
assessment is required to assist senior policy makers. The amendments 
will not have any substantial direct effects on state and local 
governments within the meaning of the Order. Therefore, no Federalism 
assessment is required.

List of Subjects in 14 CFR Part 1203

    National security information, security information.

    Accordingly, under the authority of the National Aeronautics and 
Space Act, as amended, [51 U.S.C. 20113], NASA amends 14 CFR part 1203 
as follows:

PART 1203--INFORMATION SECURITY PROGRAM

0
1. The authority citation for part 1203 is revised to read as follows:

    Authority:  E.O. 13526, E.O. 12968, E.O. 13549, E.O. 12829, 32 
CFR part 2001, and 51 U.S.C., 20132, 20133.

Subpart A--Scope

0
2. Amend Sec.  1203.100 as follows:
0
a. In paragraph (a), remove E.O. number ``12958'' from the heading and 
add in its place E.O. number ``13526'' and remove the citation ``(E.O. 
12958, 3 CFR, 1996 Comp., p. 333), as amended (See, Order of October 
13, 1995, 3 CFR, 1996 Comp., p. 513)''.
0
b. Revise paragraph (c)(1) introductory text.
0
c. In paragraph (c)(2) introductory text, add the word ``Space'' in 
front of the word ``Act''.
    The revision reads as follows:


Sec.  1203.100  Legal basis.

* * * * *
    (c) * * *
    (1) The National Aeronautics and Space Act (51 U.S.C. 20113) 
(Hereafter referred to as, ``The Space Act''), states:
* * * * *

0
3. Amend Sec.  1203.101 by revising paragraph (c) to read as follows:


Sec.  1203.101  Other applicable NASA regulations.

* * * * *
    (c) NASA Procedural Requirements (NPR) 1600.2, NASA Classified 
National Security Information (CNSI).

Subpart B--NASA Information Security Program

0
4. Amend Sec.  1203.200 as follows:
0
a. Revise paragraph (b) introductory text.
0
b. In paragraph (c), remove the quotation marks from around the words 
``The Order''.
    The revision reads as follows:


Sec.  1203.200  Background and discussion.

* * * * *
    (b) The Order was promulgated in recognition of the essential 
requirement for an informed public concerning the activities of its 
Government, as well as the need to protect certain national security 
information from unauthorized disclosure. It delegates to NASA certain 
responsibility for matters pertaining to national security and confers 
on the Administrator of NASA, or such responsible officers or employees 
as the Administrator may designate, the authority for original 
classification of official information or material which requires 
protection in the interest of national security. It also provides for:
* * * * *


Sec.  1203.201  [Amended]

0
5. In Sec.  1203.201(d), remove the words ``interchange of information, 
techniques, or hardware'' and add in their place the words ``exchange 
or sharing of information, techniques, hardware, software, or other 
technologies''.

0
6. Amend Sec.  1203.202 as follows:
0
a. Revise paragraph (a) introductory text.
0
b. In paragraph (a)(1), add the acronym ``(NISP)'' after the word 
``Program''.
0
c. In paragraph (a)(3), add the acronym ``NISPC'' after the words 
``NASA Information Security Program Committee'' and remove the words 
``NASA Information Security Program'' and add in their place the 
acronym ``NISP''.
0
d. Revise paragraph (a)(4).
0
e. In paragraph (a)(5), remove the word ``Issuing'' and add in its 
place the word ``Ensuring'' and add the words ``are developed for 
NASA'' before the word ``programs''.
0
f. In paragraph (a)(6), remove the word ``30-year-old'' and add in its 
place the word ``all''.
0
g. In paragraph (a)(7), add an apostrophe to the end of the word 
``records'' at its second occurrence.
0
h. In paragraph (a)(8), remove the words ``NASA Information Security 
Program'' and add in their place the acronym ``NISP''.
0
i. In paragraph (b), remove the words ``NASA Information Security 
Program Committee'' and add in their place the acronym ``NISPC'' and 
remove the word ``herein'' and add in its place the words ``in this 
section''.
0
j. In paragraph (c)(2), remove the words ``NASA Information Security 
Program Committee'' and add in their place the acronym ``NISPC''.
0
k. In paragraph (c)(3), add the words ``within a reasonable period'' 
after the word ``guidelines''.
0
l. In paragraph (d) introductory text, remove the words ``Officials-in-
Charge of Headquarters Offices'' and add in their place the words 
``supervisors of NASA offices''.
0
m. In paragraph (d)(2), remove the word ``eliminate'' and add in its 
place the word ``redact'' and add the words ``contained therein'' after 
the word ``information''.
0
n. In paragraph (e) introductory text, remove the words ``Directors of 
Field Installations'' and add in their place the words ``Chiefs of 
Protective Services at NASA Centers''.
0
o. In paragraph (e)(1), add the words ``and submitting the guide to the 
Office of Protective Services for review and approval'' after the word 
``Guides''.
0
p. In paragraph (e)(2), remove the word ``installations'' and add in 
its place the word ``Center''.
0
q. In paragraph (e)(3), remove the word ``eliminate'' and add in its 
place the word ``redact''.
0
r. Revise paragraph (e)(4).
0
s. In paragraph (f), remove the words ``Senior Security Specialist, 
NASA Security Office'' and add in their place the words ``Director of 
the Office of Protective Services'' and remove the words ``NASA 
Information Security Program Committee'' and add in their place the 
acronym ``NISPC''.
0
t. In paragraph (g), remove the words ``Director, NASA Security 
Management Office'' and add in their place the words ``Information 
Security Program Manager, Office of Protective Services (OPS)''.
    The revisions read as follows:


Sec.  1203.202  Responsibilities.

    (a) The Chairperson, NASA Information Security Program Committee 
(NISPC) (Subpart I of this part), who is the Assistant Administrator 
for Protective Services, or designee, is responsible for:
* * * * *
    (4) Coordinating NASA security classification matters with NASA 
Centers and component facilities and other Government agencies.
* * * * *
    (e) * * *
    (4) Coordinating all security classification actions with the 
Center's Protective Services Office.
* * * * *

0
7. In Sec.  1203.203, revise paragraphs (b)(1) and (2) to read as 
follows:


Sec.  1203.203  Degree of protection.

* * * * *
    (b)(1) Top Secret. Top Secret is the designation applied to 
information or material, the unauthorized disclosure of

[[Page 5118]]

which could reasonably be expected to cause exceptionally grave damage 
to the national security.
    (2) Secret. Secret is the designation applied to information or 
material, the unauthorized disclosure of which could reasonably be 
expected to cause serious damage to the national security.
* * * * *

Subpart C--Classification Principles and Considerations

0
8. Revise Sec.  1203.302 to read as follows:


Sec.  1203.302  Compilation.

    A compilation of items that are individually unclassified may be 
classified if the compiled information reveals an additional 
association or relationship that meets the standards of classification 
under the Order; and is not otherwise revealed in the individual items 
of information. As used in the Order, compilations mean an aggregate of 
pre-existing unclassified items of information.

0
9. Revise Sec.  1203.303 to read as set forth below.


Sec.  1203.303  Distribution controls.

    NASA shall establish controls over the distribution of classified 
information to ensure that it is dispersed only to organizations or 
individuals eligible for access to such information and with a need-to-
know the information.


Sec.  1203.304  [Amended]

0
10. Amend Sec.  1203.304 by removing the words ``in light of'' and add 
in their place the words ``and weighed against''.


Sec.  1203.305  [Amended]

0
11. Amend Sec.  1203.305 by adding the words ``or by operation of law'' 
after the word ``originated,'' adding the words ``and Formerly 
Restricted Data'' after the third occurrence of the word ``Data'', and 
adding the words ``and/or Department of Defense'' after the word 
``Energy''.

Subpart D--Guidance for Original Classification

0
12. Revise Sec.  1203.400 to read as follows:


Sec.  1203.400  Specific classifying guidance.

    Technological and operational information and material, and in some 
exceptional cases scientific information falling within any one or more 
of the following categories, must be classified if its unauthorized 
disclosure could reasonably be expected to cause some degree of damage 
to the national security. In cases where it is believed that a contrary 
course of action would better serve the national interests, the matter 
should be referred to the Chairperson, NISPC, for a determination. It 
is not intended that this list be exclusive; original classifiers are 
responsible for initially classifying any other type of information 
which, in their judgment, requires protection under Sec.  1.4 of ``the 
Order.''
    (a) Military plans, weapons systems, or operations;
    (b) Foreign government information;
    (c) Intelligence activities (including covert activities), 
intelligence sources or methods, or cryptology;
    (d) Foreign relations or foreign activities of the United States, 
including confidential sources;
    (e) Scientific, technological, or economic matters relating to the 
national security;
    (f) United States Government programs for safeguarding nuclear 
materials or facilities;
    (g) Vulnerabilities or capabilities of systems, installations, 
infrastructures, projects, plans, or protection services relating to 
the national security; or
    (h) The development, production, or plans relating to the use of 
weapons of mass destruction.


Sec.  1203.403  [Reserved]

0
13. Remove and reserve Sec.  1203.403.


Sec.  1203.405  [Amended]

0
14. Amend Sec.  1203.405 by removing from the last sentence ``, General 
Services Administration, Washington, DC 20405,'' after the word 
``Office.''

0
15. Amend Sec.  1203.406, in paragraph (b), by adding a new second 
sentence to read as follows:


Sec.  1203.406  Additional classification factors.

* * * * *
    (b) * * * The Office of Protective Services will coordinate with 
the Information Security Oversight Office (ISOO) Committee and the 
National Declassification Center to determine what classification 
guides are current. * * *

0
16. Revise Sec.  1203.407 to read as follows:


Sec.  1203.407  Duration of classification.

    (a) At the time of original classification, the original 
classification authority shall establish a specific date or event for 
declassification based on the duration of the national security 
sensitivity of the information. Upon reaching the date or event, the 
information shall be automatically declassified. Except for information 
that should clearly and demonstrably be expected to reveal the identity 
of a confidential human source or a human intelligence source or key 
design concepts of weapons of mass destruction, the date or event shall 
not exceed the timeframe established in paragraph (b) of this section.
    (b) If the original classification authority cannot determine an 
earlier specific date or event for declassification, information shall 
be marked for declassification 10 years from the date of the original 
decision, unless the original classification authority otherwise 
determines that the sensitivity of the information requires that it be 
marked for declassification for up to 25 years from the date of the 
original decision.
    (c) An original classification authority may extend the duration of 
classification up to 25 years from the date of origin of the document, 
change the level of classification, or reclassify specific information 
only when the standards and procedures for classifying information 
under this Order are followed.
    (d) No information may remain classified indefinitely. Information 
that is marked for an indefinite duration of classification under 
predecessor orders, for example, information marked as ``Originating 
Agency's Determination Required,'' or classified information that 
contains either incomplete or no declassification instructions, shall 
have appropriate declassification information applied in accordance 
with part 3 of this order.

0
17. Section 1203.408 is amended as follows:
0
a. Revise the section heading.
0
b. Amend the introductory text and paragraphs (a) and (d) by removing 
the word ``installation'' wherever it appears and adding in its place 
the word ``Center''.
0
c. Add paragraph (e).
    The revision and addition read as follows:


Sec.  1203.408  Assistance by Information Security Specialist in the 
Center Protective Services Office.

* * * * *
    (e) Forwarding all security classification guides to the Office of 
Protective Services, NASA Headquarters, for final approval.

0
18. Amend Sec.  1203.409 as follows:
0
a. Revise paragraph (a).
0
b. Amend paragraph (c) by removing number ``30'' and adding in its 
place the number ``90'' and removing ``GSA,''.
    The revision reads as follows:


Sec.  1203.409  Exceptional cases.

    (a) In those cases where a person not authorized to classify 
information

[[Page 5119]]

originates or develops information which is believed to require 
classification, that person must contact the Center's or installation's 
Information Security Officer in the Protective Services Office to 
arrange for proper review and safeguarding. Persons other than NASA 
employees should forward the information to the NASA Central Registry 
at 300 E Street SW., Washington, DC 20546, Attention: Office of 
Protective Services.
* * * * *

0
19. Amend Sec.  1203.410 as follows:
0
a. Revise paragraphs (a), (c), (d), and (e).
0
b. Remove paragraphs (f) and (g).
    The revisions read as follows:


Sec.  1203.410  Limitations.

    (a) In no case shall information be classified, continue to be 
maintained as classified, or fail to be declassified in order to:
    (1) Conceal violations of law, inefficiency, or administrative 
error;
    (2) Prevent embarrassment to a person, organization, or agency;
    (3) Restrain competition; or
    (4) Prevent or delay the release of information that does not 
require protection in the interest of the national security.
* * * * *
    (c) Information may not be reclassified after declassification 
after being released to the public under proper authority unless: The 
reclassification is based on a document-by-document review by NASA and 
a determination that reclassification is required to prevent at least 
significant damage to the national security and personally approved in 
writing by the Administrator, the Deputy Administrator, or the 
Assistant Administrator for Protective Services. All reclassification 
actions will be coordinated with the Information Security Oversight 
Office before final approval; the information may be reasonably 
recovered without bringing undue public attention to the information; 
the reclassification action is reported promptly to the Assistant to 
the President for National Security Affairs (the National Security 
Advisor) and the Director of the Information Security Oversight Office; 
and for documents in the physical and legal custody of the National 
Archives and Records Administration (National Archives) that have been 
available for public use, the Administrator, the Deputy Administrator, 
or the Assistant Administrator for Protective Services, after making 
the determinations required by this paragraph, shall notify the 
Archivist of the United States (hereafter, Archivist), who shall 
suspend public access pending approval of the reclassification action 
by the Director of the Information Security Oversight Office. Any such 
decision by the Director may be appealed by the agency head to the 
President through the National Security Advisor. Public access shall 
remain suspended pending a prompt decision on the appeal.
    (d) Information that has not previously been disclosed to the 
public under proper authority may be classified or reclassified after 
an agency has received a request for it under the Freedom of 
Information Act (5 U.S.C. 552), the Presidential Records Act, 44 U.S.C. 
2204(c)(1), the Privacy Act of 1974 (5 U.S.C. 552a), or the mandatory 
review provisions of section 3.5 of this Order only if such 
classification meets the requirements of this Order and is accomplished 
by document-by-document review with the personal participation or under 
the direction of the Administrator, the Deputy Administrator, or the 
Assistant Administrator for Protective Services. The requirements in 
this paragraph also apply to those situations in which information has 
been declassified in accordance with a specific date or event 
determined by an original classification authority in accordance with 
section 1.5 of this Order.
    (e) Compilations of items of information that are individually 
unclassified may be classified if the compiled information reveals an 
additional association or relationship that:
    (1) Meets the standards for classification under this Order; and
    (2) Is not otherwise revealed in the individual items of 
information.

0
20. Amend Sec.  1203.412 as follows:
0
a. Revise paragraphs (a)(3) and (5).
0
b. Amend paragraph (b), in the first sentence, by removing the word 
``two'' and adding in its place the word ``five.''
    The revisions read as follows:


Sec.  1203.412  Classification guides.

    (a) * * *
    (3) State the duration of each specified classification in terms of 
a period of time or future event. If the original classification 
authority cannot determine an earlier specific date or event for 
declassification, information shall be marked for declassification 10 
years from the date of the original decision, unless the original 
classification authority otherwise determines that the sensitivity of 
the information requires it be marked for declassification for up to 25 
years from the date of the original decision.
* * * * *
    (5) All security classification guides should be forwarded to the 
Office of Protective Services for review and final approval. The Office 
of Protective Services will maintain a list of all classification 
guides in current use.
* * * * *

Subpart E--Derivative Classification

0
21. Revise Sec.  1203.500 to read as follows:


Sec.  1203.500  Use of derivative classification.

    (a) Persons who reproduce, extract, or summarize classified 
information, or who apply classification markings derived from source 
material or as directed by a classification guide, need not possess 
original classification authority.
    (b) Persons who apply derivative classification markings shall:
    (1) Be identified by name and position or by personal identifier, 
in a manner that is immediately apparent for each derivative 
classification action;
    (2) Observe and respect original classification decisions; and
    (3) Carry forward to any newly created documents the pertinent 
classification markings. For information derivatively classified based 
on multiple sources, the derivative classifier shall carry forward:
    (i) The date or event for declassification that corresponds to the 
longest period of classification among the sources or the marking 
established pursuant to section 1.6(a)(4)(D) of the Order; and
    (ii) A listing of the source materials.
    (c) Derivative classifiers shall, whenever practicable, use a 
classified addendum when classified information constitutes a small 
portion of an otherwise unclassified document or prepare a product to 
allow for dissemination at the lowest level of classification possible 
or in unclassified form.
    (d) Persons who apply derivative classification markings shall 
receive training in the proper application of the derivative 
classification principles of the Order, with an emphasis on avoiding 
over-classification, at least once every two years. Derivative 
classifiers who do not receive such training at least once every two 
years shall have their authority to apply derivative classification 
markings suspended until they have received such training. A waiver may 
be granted by the Administrator, the Deputy Administrator, or the 
Assistant

[[Page 5120]]

Administrator for Protective Services if an individual is unable to 
receive such training due to unavoidable circumstances. Whenever a 
waiver is granted, the individual shall receive such training as soon 
as practicable.

Subpart F--Declassification and Downgrading


Sec.  1203.601  [Amended]

0
22. Amend Sec.  1203.601 by removing the words ``Officials authorized 
original classification authority'' and adding in their place the words 
``Authorized officials with Declassification Authority (DCA)''.

0
23. Revise Sec.  1203.602 to read as follows:


Sec.  1203.602  Authorization.

    Information shall be declassified or downgraded by an authorized 
DCA official. If that official is still serving in the same position, 
the originator's successor, a supervisory official of either, or 
officials delegated such authority in writing by the Administrator or 
the Chairperson, NISPC, may also make a decision to declassify or 
downgrade information.

0
24. Revise Sec.  1203.603 to read as follows:


Sec.  1203.603  Systematic review for declassification:

    (a) General. (1) NASA must establish and conduct a program for 
systematic declassification review of NASA-originated records of 
permanent historical value exempted from automatic declassification 
under section 3.3 of this Order. The NASA Office of Protective Services 
shall prioritize the review of such records in coordination with the 
Center Protective Service Offices.
    (2) The Archivist shall conduct a systematic declassification 
review program for classified records:
    (i) Accessioned into the National Archives;
    (ii) Transferred to the Archivist pursuant to 44 U.S.C. 2203; and
    (iii) For which the National Archives serves as the custodian for 
an agency or organization that has gone out of existence.
    (3) The Chairperson, NISPC, shall designate experienced personnel 
to assist the Archivist in the systematic review of U.S. originated 
information and foreign information exempted from automated 
declassification. Such personnel shall:
    (i) Provide guidance and assistance to the National Archives and 
Records Service in identifying and separating documents and specific 
categories of information within documents which are deemed to require 
continued classification; and
    (ii) Develop reports of information or document categories so 
separated, with recommendations concerning continued classification.
    (iii) Develop, in coordination with NASA organizational elements, 
guidelines for the systematic review for declassification of classified 
information under NASA's jurisdiction. The guidelines shall state 
specific limited categories of information which, because of their 
national security sensitivity, should not be declassified 
automatically, but should be reviewed to determine whether continued 
protection beyond 25 years is needed. These guidelines are authorized 
for use by the Archivist and the Director of the Information Security 
Oversight Office, with the approval of the Senior Agency Official, 
which is the Assistant Administrator, Office of Protective Services, 
for categories listed in section 3.3 of the Order. These guidelines 
shall be reviewed at least every five years and revised as necessary, 
unless an earlier review for revision is requested by the Archivist. 
Copies of the declassification guidelines promulgated by NASA will be 
provided to the Information Security Oversight Office, National 
Archives and Records Administration (NARA). All security classified 
records exempt from automatic declassification, whether held in storage 
areas under installation control or in Federal Records Centers, will be 
surveyed to identify those requiring scheduling for future disposition.
    (A) Classified information or material over which NASA exercises 
exclusive or final original classification authority and which is to be 
declassified in accordance with the systematic review guidelines shall 
be so marked.
    (B) Classified information or material over which NASA exercises 
exclusive or final original classification authority and which, in 
accordance with the systematic review guidelines is to be kept 
protected, shall be listed by category by the responsible custodian and 
referred to the Chairperson, NASA Information Security Program 
Committee. This listing shall:
    (1) Identify the information or material involved.
    (2) Recommend classification beyond 25 years to a specific event 
scheduled to happen or a specific period of time in accordance with the 
Order.
    (3) The Administrator shall delegate to the Senior Agency Official 
the authority to determine which category shall be kept classified and 
the dates or event for declassification.
    (4) Declassification by the Director of the Information Security 
Oversight Office (DISOO). If the Director determines that NASA 
information is classified in violation of the Order, the Director may 
require the information to be declassified. Any such decision by the 
Director may be appealed through the NASA ISPC to the National Security 
Council. The information shall remain classified pending a prompt 
decision on the appeal.
    (b) [Reserved]

0
25. Amend Sec.  1203.604 as follows:
0
a. Revise paragraphs (a) and (b).
0
b. Amend (c)(1) by removing the words ``installation which originated 
the information'' and adding in their place the words ``Office of 
Protective Services''.
0
c. Revise paragraph (c)(2).
0
d. Amend paragraph (d)(1) by removing the words ``shall be processed in 
accordance with part 1206 of this chapter'' and adding in their place 
the words ``cannot be processed under the MDR process''.
0
e. Revise paragraphs (d)(2) through (4).
0
f. Revise paragraphs (e)(1), (3) and (5).
0
g. Amend paragraph (e)(2) by removing the word ``installation'' and 
adding in its place the words ``Office of Protective Services''.
0
h. Revise paragraph (g)(2)
    The revisions read as follows:.


Sec.  1203.604  Mandatory review for declassification.

    (a) Information covered. Except as provided in paragraph (b) of 
this section, all information classified under the Order or predecessor 
orders shall be subject to a review for declassification by the 
originating agency if:
    (1) The request for a review describes the document or material 
containing the information with sufficient specificity to enable the 
agency to locate it in a reasonably timely manner;
    (2) The document or material containing the information responsive 
to the request is not contained within an operational file exempted 
from search and review, publication, and disclosure under 5 U.S.C. 552 
in accordance with law; and
    (3) The information is not the subject of pending litigation.
    (b) Presidential papers. Information originated by the President or 
Vice President; the President's White House Staff, or the Vice 
President's Staff; committees, commissions, or boards appointed by the 
President; or other entities within the Executive Office of the 
President that solely advise and assist the President are exempted from 
the provisions of paragraph (a) of this

[[Page 5121]]

section. However, the Archivist shall have the authority to review, 
downgrade, and declassify papers or records of former Presidents and 
Vice Presidents under the control of the Archivist pursuant to 44 
U.S.C. 2107, 2111, 2111 note, or 2203. Procedures developed by the 
Archivist shall provide for consultation with agencies having primary 
subject matter interest and shall be consistent with the provisions of 
applicable laws or lawful agreements that pertain to the respective 
Presidential papers or records. Agencies with primary subject matter 
interest shall be notified promptly of the Archivist's decision. Any 
final decision by the Archivist may be appealed by the requester or an 
agency to the Panel. The information shall remain classified pending a 
decision on the appeal.
    (c) * * *
    (2) For the most expeditious action, requests from other 
Governmental agencies or from members of the public should be submitted 
directly to the NASA Office of Protective Services only. The requestor 
may submit the request to: National Aeronautics and Space 
Administration (NASA), Central Registry, 300 E Street SW., Washington 
DC 20546, Attention: Office of Protective Services/Information Security 
Program Manager. The phrase, ``Mandatory Declassification Review,'' 
must be stated in the request.
    (d) * * *
    (2) The request describes the document or material containing the 
information with sufficient specificity, such as accession numbers, box 
titles or numbers, date and title of document, in any combination, to 
enable NASA to locate it with a reasonable amount of effort, not to 
exceed 30 days. If more time is required, NASA will notify the 
requester. After review, the information or any portion thereof that no 
longer requires protection shall be declassified and released unless 
withholding is otherwise warranted under applicable law.
    (3) The requester shall be asked to correct a request that does not 
comply with paragraph (d)(2) of this section, to provide additional 
information, or to narrow the scope of the request; and shall be 
notified that no action will be taken until the requester complies.
    (4) If the request requires the rendering of services for which 
fees may be charged under 31 U.S.C. 483a (1976), the rates prescribed 
in Sec.  1206.700 shall be used, as appropriate.
    (e) * * *
    (1) The NASA Office of Protective Services review upon receiving 
the initial request shall be completed within 365 days.
* * * * *
    (3) All appeals of denials of requests for declassification shall 
be acted upon and determined finally within 120 working days after 
receipt, and the requester shall be advised that the appeal 
determination is final. If the requester is dissatisfied with NASA's 
appeal decision, the requester may initiate an appeal to the 
Interagency Security Classification Appeals Panel (ISCAP), within the 
Information Security Oversight Office. If continued classification is 
required under the provisions of this part 1203, the requester shall be 
notified of the reasons thereof.
* * * * *
    (5) When the NASA Office of Protective Services receives any 
request for declassification of information in documents in its custody 
that was classified by another Government agency, it shall refer copies 
of the request and the requested documents to the originating agency 
for processing and may, after consultation with the originating agency, 
inform the requester of the referral.
* * * * *
    (g) * * *
    (2) Material not officially transferred. When NASA has in its 
possession classified information or material originated by an agency 
which has since ceased to exist and that information has not been 
officially transferred to another department or agency or when it is 
impossible for NASA to identify the originating agency and a review of 
the material indicates that it should be downgraded or declassified, 
NASA shall be deemed to be the originating agency for the purpose of 
declassifying or downgrading such material. NASA will consult with the 
Information Security Oversight Office to assist in final disposition of 
the information.
* * * * *

Subpart G--[Removed and Reserved]

0
26. Remove and reserve Subpart G, consisting of Sec. Sec.  1203.700 
through 1203.703.

Subpart H--Delegation of Authority To Make Determinations in 
Original Classification Matters

0
27. Revise Sec.  1203.800, Sec.  1203.801 and Sec.  1203.802 to read as 
follows:


Sec.  1203.800  Establishment.

    Pursuant to Executive Order 13526, ``Classified National Security 
Information,'' and The Space Act, in accordance with U.S.C. Title 51, 
National and Commercial Space Program Sections 20132 and 20133, there 
is established a NASA Information Security Program Committee (as part 
of the permanent administrative structure of NASA). The NASA Assistant 
Administrator for Protective Services, or designee, shall be the 
Chairperson of the Committee. The Information Security Program Manager, 
NASA Office of Protective Services, is designated to act as the 
Committee Executive Secretary.


Sec.  1203.801  Responsibilities.

    (a) The Chairperson reports to the Administrator concerning the 
management and direction of the NASA Information Security Program as 
provided for in subpart B of this part. In this connection, the 
Chairperson is supported and advised by the Committee.
    (b) The Committee shall act on all appeals from denials of 
declassification requests and on all suggestions and complaints with 
respect to administration of the NASA Information Security Program as 
provided for in subpart B of this part.
    (c) The Executive Secretary of the Committee shall maintain all 
records produced by the Committee, its subcommittees, and its ad hoc 
panels.
    (d) The Office of Protective Services will provide staff assistance 
and investigative and support services for the Committee.


Sec.  1203.802  Membership.

    The Committee membership will consist of the Chairperson, the 
Executive Secretary, and one person nominated by each of the following 
NASA officials:
    (a) The Associate Administrators for:
    (1) Aeronautics.
    (2) Science Missions Directorate.
    (3) Human Explorations and Operations.
    (4) International and Interagency Relations.
    (b) The Associate Administrator.
    (c) The General Counsel.
    (d) The Chief Information Officer.
    (e) Other members may be designated upon specific request of the 
Chairperson.

0
28. Add Sec.  1203.803 and Sec.  1203.804 to subpart H to read as 
follows:


Sec.  1203.803  Ad hoc committees.

    The Chairperson is authorized to establish such ad hoc panels or 
subcommittees as may be necessary in the conduct of the Committee's 
work.


Sec.  1203.804  Meetings.

    (a) Meetings will be held at the call of the Chairperson.

[[Page 5122]]

    (b) Records produced by the Committee and the minutes of each 
meeting will be maintained by the Executive Secretary.

Subpart I--NASA Information Security Program Committee

0
29. Revise Sec.  1203.900 to read as follows:


Sec.  1203.900  Establishment.

    Pursuant to Executive Order 13526, ``Classified National Security 
Information,'' and The Space Act, in accordance with U.S.C. Title 51, 
National and Commercial Space Program Sections 20132 and 20133, there 
is established a NASA Information Security Program Committee (as part 
of the permanent administrative structure of NASA. The NASA Assistant 
Administrator for Protective Services, or designee, shall be the 
Chairperson of the Committee. The Information Security Program Manager, 
NASA Office of Protective Services, is designated to act as the 
Committee Executive Secretary.


Sec.  1203.901  [Amended]

0
30. Amend Sec.  1203.901, in paragraph (d), by removing the words 
``NASA Security Office, NASA Headquarters'' and adding in their place 
the ``Office of Protective Services''.
0
31. Add subpart J to read as follows:
Subpart J--Special Access Programs (SAP) and Sensitive Compartmented 
Information (SCI) Programs
Sec.
1203.1000 General.
1203.1001 Membership.
1203.1002 Ad hoc committees.
1203.1003 Meetings.

Subpart J--Special Access Programs (SAP) and Sensitive 
Compartmented Information (SCI) Programs


Sec.  1203.1000  General.

    A SAP or SCI program shall be created within NASA only upon 
specific written approval of the Administrator and must be coordinated 
with the Assistant Administrator for Protective Services, or designee, 
to ensure required security protocols are implemented and maintained.


Sec.  1203.1001  Membership.

    The Committee membership will consist of the Chairperson, the 
Executive Secretary, and one person nominated by each of the following 
NASA officials:
    (a) The Associate Administrators for:
    (1) Aeronautics.
    (2) Science Missions Directorate.
    (3) Human Explorations and Operations.
    (4) International and Interagency Relations.
    (b) The Associate Administrator.
    (c) The General Counsel.
    (d) The Chief Information Officer.
    (e) Other members may be designated upon specific request of the 
Chairperson.


Sec.  1203.1002  Ad hoc committees.

    The Chairperson is authorized to establish such ad hoc panels or 
subcommittees as may be necessary in the conduct of the Committee's 
work.


Sec.  1203.1003  Meetings.

    (a) Meetings will be held at the call of the Chairperson.
    (b) Records produced by the Committee and the minutes of each 
meeting will be maintained by the Executive Secretary.

Charles F. Bolden, Jr.,
Administrator.
[FR Doc. 2013-00532 Filed 1-23-13; 8:45 am]
BILLING CODE P