Supply Chain Risk Management

NANADARTS, created by the Johnson Space Center, allows users to search for and receive NASA Advisories (dating back to 1990), Government-Industry Data Exchange Program (GIDEP) Notices and other similar documents on your own as long as you are within the NASA firewall.

NANADARTS benefits:

• Facilitates awareness of all nonconforming software and hardware that could pose risks to agency programs and projects.
• Allows users to perform their own searches without the center GIDEP representatives’ involvement.
• Streamlines closed-loop reporting process for all NASA centers.
  • NPR 8735.1D mandates closed-loop reporting for safety critical programs and projects.
• Creates agency-wide impact reports that show senior management how many documents are processed and the cost avoidance achieved by participating in GIDEP.

Access:

• To gain access to NANADARTS, go to https://nanadarts.nasa.gov/Document/Search
  
• To request access, go to IdMAX website at https://nams.nasa.gov
  • Once access is granted, users on the NASA NDC domain have access to summary level data in NANADARTS.
  • Higher levels of access require an approved NAMS request through IdMAX (https://idmax.nasa.gov).

In support of the Space Industrial Base Working Group (SIBWG), an interagency collaboration, NASA developed the CARITL, which consists of “at risk” building block space systems and essentially includes high Technology Readiness Level items such as raw materials, parts, components and subsystems. CARITL is managed by the NASA Engineering and Safety Center (NESC).

• Input to the CARITL comes from across NASA and is reviewed biannually at the Agency Program Management Council.
• CARITL items are categorized by mission type: Human Space Flight (HSF); Robotic Space Flight (RSF); or Common CARITL Items (CCI).
• Each NASA CARITL item is also identified by type of risk(s) [a.k.a. Industrial Base (IB) Prime Issue]: Foreign Competition; No Domestic Source; No Investment Incentive; Sole Source; Specialized Equipment; Specialized Workforce; Very Limited Market; Other.
• The approved CARITL is then used for discussions annually at the SIBWG meeting to prioritize across space agencies for support, as well as for Strategic Radiation Hardened Electronics Council and the Joint Army-Navy-NASA-Air Force Interagency discussions.
• CARITL is accessible to all NASA projects and used for awareness and assistance in mission development planning.
• CARITL is now an integrated part of NASA’s SCIC database to provide broader agency insight into the companies and space products that can potentially impact missions.

ICT SCRM is the process of identifying, assessing and mitigating the risks associated with the distributed and interconnected nature of IT products and service supply chains. ICT SCRM is managed by the NASA Office of the Chief Information Officer (OCIO).

• Address pressing challenges related to ICT globalization with a proactive risk mitigation approach.
• Ensure the quality, security, integrity and resilience of all mission-critical systems and components.

• Empower and inform NASA’s IT community to address key mission success factors through education and threat awareness.

The NASA OCIO is responsible for performing these assessments in consultation with the Federal Bureau of Investigation.

NASA's OCIO has implemented measures to ensure agency compliance with the Consolidated and Further Continuing Appropriations Act. This law requires NASA, before acquiring any IT systems, to conduct an assessment of the vulnerability of the IT systems to cyber-espionage and sabotage.

For additional information, visit https://www.nasa.gov/supply-chain-risk-management-scrm/

NASA’s Office of Chief Financial Officer (OCFO), Office of Procurement (OP), along with OSMA, have centralized the process for forecasting government CAAS for NASA contracts. 

• CAAS for Quality Assurance resource planning streamlines the process and minimizes work at the program, project and functional levels and assures oversight resources are focused on critical and complex tasks.
• The process is in line with the model instituted to forecast agency contract audit requirements.
• Although the process is coordinated annually via a formalized fiscal-year forecast, ad hoc requests may be submitted by contacting the OSMA SCRM Program Executive if needed.

The annual fiscal-year forecast process involves submission of a Letter of Delegation (LoD) by the owner (along with supporting details) into SCIC’s CAAS application.

The cost for the agency’s contract administration and audit service requirements is forecasted and includes labor hour planning for:

• Defense Contract Management Agency (DCMA)
• Support Contractors
• Defense Contract Audit Agency (DCAA)
• Independent Public Accounting Firms (contractors)
• Department of Interior (non-profit contract audit services)
• Commercial contractor for all audits, assessment, and assurance (A3) requirements

SCRA products are developed and used to help build visibility into NASA supply chains to support supplier surveillance, assessment and oversight activities, along with risk analysis and management decision-making within and across mission projects to provide insights, situational awareness, identify risks and support informed decision-making.

Types of SCRA products:

• Supplier Profile report: Provides succinct, high-level, information on scope supplier.
• Snapshot report: Summarizes supply chain events (e.g., mergers, acquisitions, shortages, disruptions, etc.) to provide general understanding.
• Hot Topic report: Intended to raise awareness on important SCRM topics, significant current events or supply chain disruptions.
• SCRA report: An in-depth research and analysis of a supplier, creation of the report involves using extensive proven techniques to integrate large amounts of available government and industry information related to the scope supplier, includes a briefing that provides a summary of the findings and highlighted concerns and recommendations.

What can SCRAs do for you?

• Provide insight of issues that may impact NASA programs and projects.
• Expose potential supplier or supply chain vulnerabilities that may not have been considered.
• Increase your knowledge related to suppliers that may be critical to your program and project’s success.
• Give you awareness of supply chain disruptions.

SCIC is a NASA information system that can be accessed by submitting a request for “AGCY NASA Supply Chain Insight Central (SCIC)” via the NASA Access Management System (NAMS).

• Perform SCRM Analytics by using SCIC Dashboards.
• Use SCIC to search for and gain insight on current/potential NASA suppliers and related supply chain data and reports, including:
  • Supplier Profiles: View available information related to supplier’s business profile, parent organization, associated NASA program/projects, key attributes, products/services supplied to NASA, and more.
  • Contracts: Access information for NASA contracts (last ten (10) years), as reported and recorded in the U.S. Federal Procurement Data System (FPDS).
  • Audit/Assessment Reports: Search for records related to previously conducted supply chain quality audits/assessments.

SCV Reporting enhances visibility into NASA’s supply chain beyond Prime Contractors (tier-1 suppliers) and strengthens its resiliency.

• Ongoing, agencywide visibility into NASA prime contractors and lower-tier suppliers is essential to the pro-active management of both risks and opportunities.
• As directed by the NASA SCRB, the implementation of SCV Reporting went into effect on June 28, 2024.
• NASA’s Procurement Information Circular 24-04 provides instructions for incorporating the approved, baseline Data Requirements Description (DRD) for SCV Reporting by NASA prime contractors into NASA contract solicitations and awards for new procurements of products and services for programs/projects on the approved Agency Mission Program and Project List (AMPL) with estimated contract values of $20 million or more; this contractually requires NASA Primes to report their subcontractors used to fulfill the corresponding NASA contract.
• The internal NASA SharePoint site for Supply Chain Visibility Requirements provides the approved, baseline DRD and related information and guidance for its incorporation into NASA procurements and the submission, review, and acceptance of the required reporting.

NASA’s SCRB recommends courses of action and sustainable solutions to surmount SCRM challenges at enterprise and operational levels.

• The SCRB supports the Acquisition Strategy Council (ASC) and the Chief Acquisition Officer (CAO) in advancing NASA strategy, policy, processes, capabilities, and organizational culture.
• The functions and operations of the SCRB are applicable to mission programs and projects and related operations undertaken and managed by NASA Headquarters and NASA Centers including Component Facilities and the Jet Propulsion Laboratory (JPL).

SCRB Functions:

• Assess, formulate, and recommend courses of action and solutions for review and decision-making by member organizations, the ASC, the ASC Chair, and/or the CAO.
• Assess, submit, and report on risks and associated recommendations and mitigations as part of the NASA Enterprise Risk Management process.
• Maintain and foster communication, information sharing, and collaborations among the SCRB members, member organizations and their related programs, functions, activities, including other organizations internal and external to NASA.
• NASA-level coordination, perform review and decision-making pertaining to NASA strategy, policy, initiatives, and actions, including matters involving legislation, public laws, executive orders, and strategic stakeholders.
• Work action plans and provide status information and briefings as determined by the SCRB Chair and the ASC Chair.
• Make decisions on board recommendations, actions, and activities.

This charter establishes the National Aeronautics and Space Administration (NASA) Supply Chain Resiliency Board (SCRB), and sets forth its applicability and scope, the authority for its establishment, and its governing council affiliation, functions, membership, meetings, duration, assessment, and records.

This NASA Procedural Requirements document provides the requirements for risk management for the agency, its institutions, and its programs and projects as required by NPD 1000.0, Governance and Strategic Management Handbook; NPD 7120.4, Program/Project Management; and NPD 8700.1, NASA Policy for Safety and Mission Success. Risk management includes two complementary processes: Risk-Informed Decision Making and Continuous Risk Management.

This document establishes the requirements by which NASA formulates and implements space flight programs and projects, consistent with the governance model contained in NASA Policy Directive (NPD) 1000.0, NASA Governance and Strategic Management Handbook.