Data restrictions
The NASA Science Cloud supports FISMA Low by default. Some specifically designated accounts support FISMA Moderate.
Do not transfer, upload, store, process, or publish the following in the NASA Science Cloud:
- Personally Identifiable Information (PII)
- International Traffic in Arms Regulations (ITAR)-controlled data
- Export Administration Regulations (EAR)-controlled data
These restrictions also apply to FISMA Moderate accounts. A Moderate designation does not authorize PII, ITARauthorize ITAR-controlled data, or EAR-controlled data.
...
- Transfers out of the NASA Science Cloud
- Public release or publication approval
- Enterprise network architecture Transfers of PII
- Transfers of ITAR-controlled data
- Transfers of EAR-controlled data
- Exceptions to NASA security requirements
...
- The destination account is specifically designated to support FISMA Moderate.
- The selected storage location is part of the Moderate environment.
- The transfer uses the account’s established identity, encryption, logging, and monitoring controls. The dataset does not contain PII
- .
- The dataset does not contain ITAR-controlled data.
- The dataset does not contain EAR-controlled data.
- Any project-specific Moderate handling procedures are followed.
...
For example, a scientific dataset containing a small amount of PII must not be uploaded, even if the remainder of the dataset is public or FISMA Low – PII requires FISMA Moderate. Remove the prohibited content and complete any required review before transferring the dataset.
...
| Question | Required response | ||
|---|---|---|---|
| Has the data owner identified the applicable FISMA impact level? | If no or unknown, stop and obtain a determination | ||
| Is the data FISMA Low? | It may be transferred to a standard Science Cloud account | ||
| Is the data FISMA Moderate? | Confirm that the destination is a specifically designated Moderate account | Does the dataset contain PII? | If yes or unknown, do not transfer |
| Is the dataset controlled under ITAR? | If yes or unknown, do not transfer | ||
| Is the dataset controlled under EAR? | If yes or unknown, do not transfer | ||
| Is the destination appropriate for the data’s impact level? | If no or unknown, do not transfer | ||
| Is the intended landing location identified? | If no, obtain the destination before starting | ||
| Are access controls, encryption, and logging configured? | If no or unknown, resolve the configuration before transfer | ||
| Are validation and acceptance criteria documented? | If no, define them before the production transfer |
...
The transfer method does not change the data eligibility rules. No transfer service authorizes PII, ITARauthorizes ITAR-controlled data, EAR-controlled data, or data above the destination account’s supported impact level.
...
- Confirm that its records do not contain PII, ITARcontain ITAR-controlled data , or EAR-controlled data.
- Confirm its FISMA impact level.
- Identify dependencies, users, schemas, extensions, and version requirements.
- Test application compatibility.
- Define a consistency-validation and cutover plan.
- Preserve the source until the migrated database is accepted.
...
A quarantine area is not an approved location for PII, ITARfor ITAR-controlled data , or EAR-controlled data. Identify prohibited data before upload.
...
- Dataset name and owner
- Source system and source path
- Destination account and storage location
- FISMA impact level Confirmation that the data contains no PII
- Confirmation that the data contains no ITAR-controlled information
- Confirmation that the data contains no EAR-controlled information
- Total logical size
- Number of files
- Largest file
- Average file size
- Directory depth
- File formats
- Compression status
- Expected growth rate
- Transfer deadline
- Required retention period
- Whether the source will change during transfer
- Metadata that must be preserved
- Dataset-specific acceptance criteria
...
- FISMA Low is supported by default.
- FISMA Moderate is supported only in specifically designated environments.
- PII is not permitted.
- ITAR-controlled data is not permitted.
- EAR-controlled data is not permitted.
- Azure service certifications do not expand the authorization of a NASA environment.
...
- The dataset does not contain PII
...