Appendix C. Requirements Mapping Matrix

C.1 The rationale for the requirements is contained in the NASA-HDBK-2203. Programs/Projects may substitute a matrix that documents their mapping with their particular Center’s implementation of NPR 7150.2, if applicable. See NASA-HDBK-2203 for requirements mapping matrices organized by class, tailoring field for each requirement, tailoring rationale, and approval signature lines.

C.2 The Requirements Mapping Matrix documents the program/project’s mappings or intent to comply with the requirements of this NPR or justification for tailoring. The matrix lists:

1. The section reference.
2. The unique requirement identifier.
3. The NPR 7150.2 requirement statement.
4. The Authority Level responsible for assessing a project’s requirements mapping matrices and any requested tailoring from requirements in this NPR. The CIO, or the designee, has institutional authority on all Class F software projects and has joint responsibility on the cybersecurity requirements in Section 3.11.
5. The applicability of the requirements in this NPR to specific systems and subsystems within the Agency’s investment areas, programs, and projects is determined through the use of the NASA-wide definition of software classes.

C.3 Tailoring Guidance

X - Indicates an invoked requirement by this NPR consistent with Software Classification (ref. SWE-139). May be tailored with TA approval (ref. Chapter 2.2).

Blank - Optional/Not invoked by this NPR.

Center - Center Director or the Center Director’s designated ETA, the Center Director’s designated SMA TA, and the CHMO designated for Health and Medical TA. The NASA CIO, or the designee, has institutional authority on all Class F software projects and has joint responsibility with the ETA on the cybersecurity requirements in Section 3.11 per the direction in the Requirements Mapping Matrix.

CIO - The NASA CIO, or the designee Center CIO, has institutional authority on all Class F software projects and has joint responsibility with the ETA on the cybersecurity requirements in section 3.11, per the direction in the Requirements Mapping Matrix.

Each requirement marked ‘X’ for the project’s software classification(s) should be addressed in the Requirements Mapping Matrix. All requirements can be tailored per the guidance in this directive. Requirements that are not applicable to a given project, such as the IV&V requirements, should be tailored out in the Requirements Mapping Matrix with justification.