| NODIS Library | Legal Policies(2000s) | Search |

NASA Ball NASA
Procedural
Requirements
NPR 2210.1C
Effective Date: August 11, 2010
Expiration Date: August 11, 2015
COMPLIANCE IS MANDATORY
Printable Format (PDF)

(NASA Only)

Subject: Release of NASA Software

Responsible Office: Office of the Chief Technologist


| TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | AppendixD | AppendixE | AppendixF | ALL |

Chapter 2. Reporting, Review, and Assessment of Software

2.1 Center Awareness and Orientation Activities

2.1.1 The Center SRA shall conduct awareness activities and orientation sessions for Center civil servants and contractors to support the implementation of this NPR.

2.2 Software Reporting

2.2.1 Software subject to this NPR, as described in paragraph P.2 and as determined by the Center SRA under paragraph 1.7, shall be reported to NASA. 

2.2.1.1 The Center SRA shall ensure that software is reported in accordance with this section 2.2 and is inventoried in the NTTS.

2.2.2 The reporting requirement applies to new software that has not yet been reported and to software previously reported where new functionality or new innovators have been added to the software since it was reported. 

2.2.2.1 The reporting requirement does not apply to bug fixes or minor enhancements that the Center SRA has determined are not subject to this NPR. If there are questions on reporting software, contact the Center Patent or IP Counsel or other Center personnel responsible for assisting in the reporting of inventions.

2.2.3 Except for an Approved for NASA Release (as defined in A.2.6.5), software shall be reported prior to any release.

2.2.3.1 To minimize delays during software development or review among NASA Centers, if approved by the Center SRA, software released as an Approved for NASA Release may be reported after the release.

2.2.4 In accordance with NPD 2091.1, Inventions Made By Government Employees, each NASA employee who makes an invention embodied by software shall report such invention to the Center Patent or IP Counsel or other Center personnel responsible for assisting in the reporting of inventions.

2.2.5 In accordance with the Patent Rights or New Technology clauses in NASA contracts and subcontracts, contractors and subcontractors shall report subject inventions and reportable items that include software created by their employees to the NASA New Technology Representative named in their contracts.

2.2.5.1 The NASA New Technology Representative shall provide the Center Patent or IP Counsel with access to contractor New Technology Reports (NTR) disclosing software.

2.2.6 Generally, NASA does not use grants to develop software; however, where a grantee has developed software as a consequence of performing activities under a grant, the grant obligates the grantee to report the software if it is considered to be a potentially patentable software-related invention.

2.2.7 Software shall be reported electronically using the NASA electronic New Technology Reporting system (eNTRe) located at http://invention.nasa.gov (preferred method) or in hard copy using NASA Form (NF) 1679 "Disclosure of Invention and New Technology (Including Software)," also available at the eNTRe web site.

2.2.7.1 All software disclosures shall:

a. Identify the individuals contributing to the concept expressed by the software (i.e., the underlying functional method or process that is implemented by the software) as well as those individuals involved in coding the actual software;

b. Indicate where the software is an improvement or innovation and provide version number;

c. Identify any proprietary software, software owned by a non-Federal entity, or open source software that is incorporated into the software being disclosed; and,

d. Indicate whether a license has been obtained in situations where proprietary software, software owned by a non-Federal entity, or open source software has been incorporated into the software being disclosed and attach a copy of the license to the disclosure.

2.3 Review and Assessment Coordination

2.3.1 The Center SRA shall coordinate the review and assessment of reported software by the Center Patent or IP Counsel as described in Section 2.4, the Center official designated by the Center Director, or his/her designee(s), as described in Section 2.5, the CEA as described in Section 2.6, and the Center ITSM as described in Section 2.7.

2.4 Intellectual Property and Releasability Rights Assessment

2.4.1 The Center Patent or IP Counsel shall provide appropriate legal counsel with respect to an Intellectual Property and Releasability Rights Assessment of all reported software to determine NASA's rights in the software, to determine the suitability of software for patent and/or copyright protection, and to identify any appropriate release restrictions as defined in paragraphs 2.4.4.1 to 2.4.4.4.

2.4.2 The Center Patent or IP Counsel shall provide appropriate legal counsel with respect to the Government’s rights in software for the purposes of assessing NASA's right to release the software. Determination of the Government’s rights is required before the software may be released.

2.4.2.1 In order to release the software, the Government must have clear rights in the software, such as an ownership interest, a Government purpose license, or other appropriate license or permission from third party owners.   If the reported software does not include any proprietary software or software owned by a Non-Federal entity, or the Government has a license/permission to use any such software included in the reported software (e.g. Government Purpose or Open Source license), the software may be preapproved as “Approved for U.S. Government Purpose Release,” as defined in A.2.6.

2.4.2.2 Where it is known that Open Source Software, as defined in A.1.7, is included in software proposed for release, the Center Patent or IP Counsel shall prior to any release:

a. Review the external Open Source Software license and assess any special risks that may be involved; and

b. Confirm that NASA has obtained clear rights from any third party rights owners (such as through an assignment or license) to make the Open Source Release.

2.4.2.3 When it is known that Open Source Software Development, as defined in A.1.8., may be used as part of a NASA project, the Center Patent or IP Counsel shall consult with the Office or Project that has responsibility for acquisition or development of the software (see 1.8.3.) to assess any risks that may negatively impact NASA’s intended use.

2.4.3 The Center Patent or IP Counsel shall provide appropriate legal counsel for determining the suitability of reported software for patent and/or copyright protection.

2.4.3.1 The Center Patent or IP Counsel shall provide appropriate legal counsel in the determination of authors and inventors of software and whether (1) the software qualifies as patentable subject matter, and (2) is a work of the U.S. Government as defined in paragraph 2.4.3.3. The software invention, e.g., the underlying functional concepts and/or ideas implemented by the software, may be protected through patenting, whereas the actual software code, which expresses those concepts, may also be protected through copyright.

2.4.3.2 Patents. NASA can obtain domestic and/or foreign patents on the ideas, algorithms, and processes underlying the software if they satisfy the requirements for patentable subject matter. Normally, all parties with an ownership interest must assign their interest in the software to the Government before NASA will file a patent application.

2.4.3.3 Copyrights. Software created solely by an officer or employee of the U. S. Government as part of that person's official duties is a work of the U. S. Government.  Copyright protection is not currently available in the United States for a work of the U. S. Government.   However, the Government can claim foreign copyrights for software created by its employees and can receive and hold U.S. and foreign copyrights transferred to it by assignment.

2.4.3.4 NASA can direct its contractors to assert their worldwide (U.S. and foreign) copyright and assign it to the U.S. Government when software is created under a NASA contract.   If the contractor provides an acceptable plan to commercialize the software, the Contracting Officer, in consultation with the Center Patent or IP Counsel and the Center Office or Project that has responsibility for the software, may provide the contractor written permission to assert copyright in the software code. Where such permission is provided, the contractor retains the copyright with the Government retaining a license for use by and for the Government.  This Government purpose license does not, however, include the right to distribute the software to the public.  Such software may be distributed for Government purposes as defined in paragraphs 2.4.4.3 and A.2.6, unless a broader license has been obtained by the Government.

2.4.4 Center Patent or IP Counsel shall provide appropriate legal counsel with respect to evaluating and classifying reported software under one or more of the categories listed in the following subparagraphs.   As circumstances change, the software may be reevaluated and reclassified as appropriate.

2.4.4.1 Releasable Without Nondisclosure Obligations.   Software that has been categorized as Approved for Public Release and becomes Publicly Releasable Software as defined in paragraph A.1.9 is releasable without nondisclosure obligations in the SUA.  Software that has not been categorized as Approved for Public Release but (a) is a work of the U.S. Government as defined in paragraph 2.4.3.3, (b) is not export restricted, (c) is not and is not expected to be the subject of a patent application, and (d) for which there is no plan for further development or beta testing, may be released without nondisclosure obligations in the SUA.  This type of release shall be used with caution to avoid creating a statutory bar to patenting. 

2.4.4.2 Releasable With Nondisclosure Obligations.   In general, software, as valuable property, is not an Agency record under the FOIA, and, therefore, is not subject to the mandatory disclosure provisions of the FOIA.  Thus, with limited exceptions, software may be categorized as releasable with nondisclosure obligations.   The limited exceptions include software that (a) contains an embedded computer database that is itself releasable under the FOIA, (b) is so related to a releasable computer database that the computer database would be unintelligible or unusable without the software, and (c) preserves information relative to the Agency's structure, operation, or decision-making process.

a. To avoid creating a statutory bar for patenting, software that is being reviewed by the Center Patent or IP Counsel for patentable subject matter and the filing of a patent application shall be categorized as releasable with nondisclosure obligations.

b. Additionally, software that is part of an application for patent filed in the U. S. Patent and Trademark Office, or with any foreign patent office, shall be categorized as releasable with nondisclosure obligations.

c. Software categorized as Releasable with Nondisclosure Obligations shall include nondisclosure provisions in the SUA when released.

2.4.4.3 Releasable Only for U.S. Government Purposes.  Software that has U.S. Government purpose only restrictions on use, copying, distribution, etc., shall be categorized as Releasable Only for U.S. Government Purposes.

a. Software so categorized shall be used only for U.S. Government purposes.  A U.S. Government purpose is any activity in which the U. S. Government is a party, including contracts, grants, cooperative agreements, and Space Act Agreements.

b. Government purposes include a release for use in competitive procurements for the Government, but do not include a release for commercial purposes or a release to the public. Thus, the Government may release or disclose such software outside the Government and authorize persons to whom release or disclosure has been made to use, modify, reproduce, release, perform, display, or disclose the software for Government purposes only.

c. Center Patent or IP Counsel shall determine whether nondisclosure provisions should be included in an SUA for release of software categorized as Releasable Only for U.S. Government Purpose.

2.4.4.4 Not Releasable.  This category includes software in which the associated copyright is owned by a non-Federal party.  Software in the lawful possession of NASA that was obtained under a contract, license, or other agreement that prohibits any further use, duplication, or disclosure, shall be categorized as Not Releasable; and, unless subsequent permission is granted by its owner, such software shall not be released.  Even with such permission, an export control assessment in accordance with paragraph 2.6 is required if the proposed release is to a foreign person.

2.4.4.5 Licensable Software.  Software categorized as Licensable Software, as defined in paragraph A.1.4, shall be consistent with technology transfer objectives and shall be coordinated with the Center Patent or IP Counsel and the Center official designated by the Center Director, or his/her designee(s).

a. The licensing of software is governed by Government-wide licensing regulations (37 CFR Part 404) and NPR 2090.6, Authority to Enter Into License Agreements and Implementation of Licensing Authority.

b. While the licensing of software under NPR 2090.6 is not considered a release under this NPR, in general, before Licensable Software is approved for licensing, it normally goes through the same review and assessment process as described in this Chapter.

2.5 Technology Transfer Assessment

2.5.1 The Center official designated by the Center Director, or his/her designee(s), shall coordinate an assessment of any reported software's TRL and technology transfer potential.

2.5.1.1 The assessment shall consider the software's value or utility to potential private or public sector users and applications outside of NASA.  Software Technology Readiness Levels are provided in Appendix E.  Section 4.6 of NPR 7500.1, NASA Technology Commercialization Process, provides guidance on providing assessments of technical transfer potential.

2.5.2 External individuals or organizations and NASA contractors, grantees, and Space Act Agreement partners, with whom NASA has nondisclosure arrangements to protect against the unintended public release of NASA-funded software, may provide research and analysis in support of the Technology Transfer Assessment.

2.5.3 The assessment shall include strategies and recommendations for the transfer of the software which will maximize its benefit to NASA, the U.S. public, and the U.S. economy.

2.5.4 Upon approval by the Center SRA, a Project Release for use under a NASA contract or grant may be made prior to a Technology Transfer Assessment (see also 3.2.5.2.a).

2.6 Export Control Assessment

2.6.1 The decision to support a foreign release of software (i.e., a release made directly to, or made accessible to, any individual outside of the United States or a foreign person in the United State) shall be made by the Center SRA in consultation with the Center Office or Project that has responsibility for the software and the CEA.

2.6.2 A foreign release of software may be made only if the CEA approves the release. Prior to approval of a foreign release, the CEA shall conduct an Export Control Assessment of software to determine export control requirements and shall provide guidance and oversight to ensure that any intended foreign release of software complies with applicable export control laws and regulations as well as the NASA Export Control Program.

2.6.2.1 The CEA shall ensure that any intended foreign release of NASA software complies with:

a. The U.S. State Department’s International Traffic in Arms Regulations for software falling within the scope of the United States Munitions List, or

b. The U.S. Department of Commerce’s Export Administration Regulations for software falling within the scope of the Commerce Control List, as applicable.

2.6.2.2. While an export control assessment is only required for a release that legally constitutes an export, it may be requested and used for decision making by the Center SRA in determining appropriate categorization and availability for release in other situations.

2.6.3 All requests for the release of command and control (C&C) software for flight operations shall have the endorsement of the NASA Center or Program officials with management responsibility for development, acquisition, and implementation of the requested C&C software.

2.6.3.1 All requests for the release of C&C software are subject to the Export Control Assessment established by this NPR. The Center Counter-Intelligence official shall be consulted as part of the export control assessment of C&C software.

2.6.3.2 During the Export Control Assessment of C&C software considered for release, the CEA, as warranted, shall consult with the Center Inspector General's Office.

2.6.4 Applicability - The export control laws cover the release of technical data, including software, outside the United States and the release of technical data, including software, to a foreign person in the United States, to a U.S. person representing a foreign person, or to persons on U.S. sanctioned-parties or denied-parties lists (see NPR 2190.1).

2.6.4.1 A release of software to a foreign person located in the United States or abroad or broad access by the public (e.g., on the Internet) are both considered to be an export.

2.6.4.2 A Public Release, as described in paragraph A.2.2, or an Open Source Release, as described in paragraph A.2.3, is always considered an export due to its availability to any foreign person, and thus requires CEA approval.

2.6.4.3 A U.S. and Foreign Release as described in paragraph A.1.2.4 may be an export, depending on the recipient.

2.6.4.4 A release of export-controlled software shall include the appropriate export classification and be limited to U.S. persons as defined in title 22 CFR 120.15 and parties not appearing on any U.S. sanctioned-parties or denied-parties lists unless approval to export the software has first been obtained by the CEA.

a. Additionally, any software that is being exported shall prominently display appropriate Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) legends, if the software has been determined to be export controlled by the CEA.

2.6.5 Unauthorized Foreign Release - An employee who releases export-controlled software without authorization risks violating the EAR or the ITAR, which may result in criminal, civil, or administrative action against both the Agency and the employee.

2.7 Information Technology Security Assessment

2.7.1 The Center ITSM shall advise and assist the Center SRA and the responsible software development and assurance organizations in the identification and the mitigation or elimination of information technology security risks associated with the release of software considered within the scope and purpose of this NPR.  A key objective of Center ITSM advice and assistance is to ensure the integrity of NASA information technology systems and to prevent unauthorized access to NASA computing resources.

2.7.2 ITSM guidance may include a standard checklist or specific criteria for use by the Center SRA and/or the responsible software development and assurance organizations in performing an IT security assessment of all software considered for release.  An example of a standard checklist for IT Security compliance is provided in Appendix F.

2.7.3 If the checklist requires interpretation in its application, the Center SRA or the responsible software development and assurance organizations shall consult with their Center ITSM to provide clarification.

2.7.3.1 Software that is modified to mitigate or eliminate identified IT Security risks prior to its release shall be reassessed upon the documented completion of risk reduction measures.

2.7.4 The results of the IT security assessment of the software considered for release shall be documented by the software development organization project manager, in accordance with NPD 7120.4, and provided to the Center SRA for use in determining the release of software in accordance with the ITSM guidance.

2.7.4.1 A copy of the assessment results shall be provided to the Center ITSM. The Center SRA and the Center ITSM, as deemed warranted by either party, shall jointly consider a given IT security assessment prior to the release of the subject software.

2.8 SRA Release Determination

2.8.1 The Center SRA shall ensure that the release of applicable software created by and for the Center is accomplished in accordance with this NPR and in a timely manner.

2.8.2 Upon consulting with the Software Innovator, the Center SRA has the authority to categorize software as Software Code Baseline, Software Product Baseline, Software Accepted (As Built) Baseline, or Publicly Releasable Software as those terms are defined in paragraph A.1, Software Terminology.

2.8.3 When a release of NASA software is requested, the Center SRA shall consult with the Center Office or Project that has responsibility for the software to determine a recommended release category as described in paragraph A.2, Release Terminology.

2.8.4 In establishing release restrictions for specified software, the Center SRA shall consider programmatic objectives and the recommendations and determinations resulting from the release assessments described in paragraphs 2.4 through 2.7.

2.8.4.1 The Center SRA shall then identify, consistent with the established release restrictions, the approved option(s) for releasing specified software as defined in paragraph A.2 and implemented in Chapter 3.

2.8.5 Finally, the Center SRA will consult with the Center Patent or IP Attorney to determine the proper SUA for a release of NASA software. A list of the type of model SUAs is provided in Appendix A.D.  A model SUA(s) may be revised for a particular release only after consultation with the Center Patent or IP Counsel or designee.

2.8.6 Except in the case of an Open Source Release (see 3.2.2.3.), a SUA shall be signed or otherwise agreed to by the recipient before the requested software may be released to the recipient.

2.8.6.1 In the case of a Public Release or an Open Source Release, a recipient’s agreement may be, for example, by click-wrap agreement or terms of use under the agreement. 

2.8.6.2  In the case of a Project Release under a Government contract, software may be released by NASA to NASA’s support service contractors as Government Furnished Information (GFI) under the contract, and the contract or other Contracting Officer direction may serve as the SUA if the Center Patent or IP Counsel concurs.  If software is to be released as GFI, the SRA shall work with the applicable Contracting Officer and obtain sufficient information to document the release.

2.8.6.3 A SUA issued for any purpose other than an Open Source Release shall, at a minimum, include a Software Release Record as defined in paragraph A.1.17 and described in 3.6.1, the disclaimer and indemnification provisions as required in paragraph 3.4 and the notices of paragraph 3.5 as required in this NPR and may also include provisions for nondisclosure and export control as required.

2.8.6.4 A SUA shall also specify any restrictions on use and disclosure of said software imposed by NASA on the recipient.

2.8.6.5 For all releases other than an Intra-NASA Release, Open Source Release or Public Release via click wrap agreement, a SUA shall be issued by the Center SRA (or Contracting Officer if released under 2.8.6.2), or designee, and an original SUA or Software Release Record shall be retained by the SRA, or designee.

2.8.7 Each software release shall be documented in the NTTS. 

2.8.7.1 An SUA is a Government record and shall be maintained for disposition per guidance provided in NPD 1440.6, NASA Records Management, and NPR 1441.1, NASA Records Retention Schedules.



| TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | AppendixD | AppendixE | AppendixF | ALL |
 
| NODIS Library | Legal Policies(2000s) | Search |

DISTRIBUTION:
NODIS


This Document Is Uncontrolled When Printed.
Check the NASA Online Directives Information System (NODIS) Library
to Verify that this is the correct version before use: http://nodis3.gsfc.nasa.gov