a. This NPR is applicable to NASA Headquarters and Centers, including Component Facilities.

b. This NPR is applicable to the protection and release of all unclassified software:

(1) Created exclusively by, or jointly with, NASA employees as part of the NASA employee's official duties;

(2) Created by a non-federal party where intellectual property rights to the software have been assigned to the U. S. Government, or have been licensed to the Government where the license authorizes the Government to grant sublicenses; or

(3) In the lawful possession of NASA, except as otherwise stated in subparagraphs d through h.

c. This NPR applies to new software, or any preexisting software that may have significant commercial value or utility to potential private or public sector users or applications outside of NASA.

d. Reserved

e. Reserved

f. This NPR does not apply to computer databases or web pages with integrated databases, data input to, or output from a computer program (such as data models), software documentation, web pages, or commercial software as these terms are defined in Section 2.1. In accordance with applicable laws and regulations, Centers have discretionary authority to publicly release computer databases and software documentation depending on the Government's rights and obligations with regard to such data. Upon request, and depending on the Government's intellectual property rights, NASA computer programs that are used to read and manipulate computer databases should be publicly released with the computer databases, but only if such computer programs are not commercially available.

g. This NPR is applicable to JPL to the extent specified in its contract.

h. In general, Software, as defined in Section 2.1, is not considered a record under the Freedom of Information Act (FOIA) and, therefore, is not subject to the mandatory release requirements of the FOIA. Requests for software under the FOIA should be coordinated between the Center FOIA Office and the Center Software Release Authority.

a. NPD 1440.6, NASA Records Management.

b. NPR 1441.1, NASA Records Retention Schedules.

c. NPD 2000.1, Authority To Take Certain Actions For The General Council.

d. NPD 2091.1, Inventions Made By Government Employees.

e. NPD 2092.1, Royalties and Other Payments Received by NASA from the Licensing or Assignment of Inventions

f. NPR 2092.1, Distribution of Royalties Received by NASA from the Licensing or Assignment of Inventions

g. NPD 2210.1, External Release of NASA Software.

h. NPD 2810.1, Security of Information Technology.

i. NPR 2810.1, Security of Information Technology.

j. NPD 2820.1, NASA Software Policies.

k. NPD 2190.1, NASA Export Control Program (NASA/ECP).

l. NPR 2190.1, NASA Export Control Program.

m. NPD 2110.1, Foreign Access to NASA Technology Transfer Materials.

n. NPD 7120.4, Program/Project Management.

o. NPR 7120.5, Program and Project Management Processes and Requirements.

p. NPD 7500.2, NASA Technology Commercialization Policy.

q. NPR 7500.1 NASA Technology Commercialization Process.

r. NPR 8730.4, Software Independent Verification and Validations (IV&V) Policy

s. PIC 01-04, Guidance for Headquarters Acquisition Strategy Meetings.

1.2.1. The implementation of NPD 2210.1 and this NPG at the Centers is the responsibility of the designated parties as follows:

1.2.1.1. The Center Patent or Intellectual Property Counsel (or the Manager for Technology Transfer Division, or designee, at Centers without Patent or Intellectual Property Counsel) is responsible for performing an Intellectual Property Assessment of software considered within the scope and purpose of NPD 2210.1 and this NPR.

1.2.1.2. The Director, Center Commercial Technology Office, or designee, is responsible for coordinating a technology commercialization assessment of software deemed within the scope and purpose of NPD 2210.1 and this NPR.

1.2.1.3. The Center Export Administrator is responsible for coordinating an export control assessment on all software prior to any foreign release as defined in paragraph 2.2.3 (i.e., assisting with a determination if the software, or some portion thereof, should be subject to export restrictions under either the Export Administration Regulations or the International Traffic in Arms Regulations). When a foreign release of software is contemplated (including a release to a foreign entity within the United States), the Center Export Administrator will be consulted to ensure that such release complies with applicable export laws and regulations, and the NASA Export Control Program.

1.2.1.4. The Center Director, or designee, is responsible for appointing an individual as the Software Release Authority, or for appointing a group of individuals as the Software Release Group. A Software Release Group must have a team leader or chairperson designated as the Software Release Authority. The Software Release Authority may establish supplemental procedures and guidance to support the implementation and administration of NPD 2210.1 and this NPR.

1.2.1.5. The NASA Inspector General, or designee, is responsible for appointing an individual or group of individuals as the Software Release Authority for the purpose of determining the release of forensic software developed by the Office of Inspector General for law enforcement purposes. The Software Release Authority appointed for this purpose shall comply with the requirements of the NPD and this NPR 2210.1.

1.2.1.6. The NASA Principal Center for Information Technology Security (PCITS) is responsible for developing guidance, including a standard checklist to assist the Centers in the identification and the mitigation or elimination of information technology security risks associated with the external release of software considered under the auspices of NPD 2210 and this NPR. The Center IT Security Manager (ITSM) will provide advice and interpretation of the guidance for the IT security assessment of all such software, and shall be consulted, as warranted by the guidance, by the Center SRA and the cognizant software development and assurance organizations prior to the release of the software.

1.2.1.7. The Center Information Technology Security Manager is responsible for identifying to the Software Release Authority any security risks inherent in the release of specific software and for determining how to eliminate or manage those risks as needed.

1.2.1.8. The Software Release Authority is responsible for determining the applicability of this NPR to software that may be outside the purpose and scope of NPD 2210.1, and for ensuring that all external releases of applicable software are accomplished in accordance with NPD 2210.1 and this NPR. Accordingly, the Software Release Authority is responsible for managing the implementation of NPD 2210.1 and this NPR in coordination with the Center Patent or Intellectual Property Counsel, the Manager for the Technology Transfer Office, the Center Export Administrator, the Center Information Technology Security Manager, the Center Procurement Office, the Center office responsible for the software and other Center offices, as may be necessary.

2.1.1. Software as used in NPD 2210.1 and this NPR, means computer programs, executables, source code, and object code. Software does not include computer databases or software documentation. Additionally, while design details, algorithms, processes, flow charts, formulae and related material that would enable a particular NASA software, or a functional equivalents thereof, to be reproduced or created are not subject to NPD 2210.1 and this NPR, their premature release may jeopardize intellectual property protection and commercialization of software to which they relate. Thus, such related information and materials must not be released unless the Center Patent Counsel has approved the software for release. If the software has been approved for release under one of the release categories defined in section 2.2, the design details, algorithms, processes, flow charts, formulae and related materials may be released at an equivalent level of release.

2.1.2. "Computer Programs" means a set of statements or instructions to be used directly or indirectly in a computer in order to bring about a certain result.

2.1.3. "Source Code" means a representation of object code in an advanced programming language, such as BASIC, FORTRAN, C++, Ada, JAVA and SQL.

2.1.4. "Object Code" means machine language; that programming language which is directly readable and executable by a computer.

2.1.5. "Commercial Software" means software developed or regularly used for non-governmental purposes which: a. Has been sold, leased, or licensed to the public;

b. Has been offered for sale, lease, or license to the public;

c. Has not been offered for sale, lease, or license to the public, but will be available for commercial sale, lease, or license in time to satisfy the delivery requirements of a Government contract; or

d. Satisfies a criterion expressed in 2.1.5.a, 2.1.5.b, or 2.1.5.c. and would require only minor modification to meet the requirements of a Government contract.

2.1.6. "Licensable Software" means software for which the U.S. Government owns a domestic or foreign copyright, patent application, or patent incorporating the software.

2.1.7. "Publicly Releasable Software" means software for which a recommendation for General Public Release has been made to the SRA by the Center Office or Project that has the responsibility for the software with concurrence by the Manager for Technology Transfer Division, or designee, with concurrence by the Center Patent or Intellectual Property Counsel, and the Center Export Administrator.

2.1.8. "Database" means a collection of data in a form capable of being processed by a computer through the use of a computer program performing the function of storing, manipulating, or formatting. A Computer Database is not software.

2.1.9. "Software Documentation" - This documentation explains the capabilities of the software, or provides operating instructions for using the software to obtain the desired results and is represented as, owner's manuals, user's manuals, installation instructions, operating instructions, and other similar items. If software documentation includes design details, algorithms, processes, flow charts, formulae, and related material that would enable a particular NASA software, or a functional equivalents thereof, to be reproduced or created, the software documentation should not be released until the software to which it apples has been approved for release.

2.1.10. Software Code Baseline - This baseline is established at the end of the software implementation phase. During the software implementation phase, the software is coded and unit tested. All documentation is produced in quasi-final form, including internal code documentation. At the end of the phase, all required products should be ready for delivery, subject to modification during integration and testing. It should include: 1) software detailed design specification, 2) build and test plans, 3) The code itself, 4) Code level documentation, 4) Users Manuals, 5) Test Procedures for the Integration and Test Phase, and 6) Data needed for operation of the software.

2.1.11. Software Product Baseline - This baseline is established at the completion of the Integration and Test Phase. The software is to be ready for acquirer acceptance testing and delivery. It should include, in addition to the updated contents of the Software Code Baseline, the following:

a. The tested code, and

b. Final versions of all products and documents

2.1.12. "Software Accepted (As-Built) Baseline" - This baseline is established after the software has been accepted by the intended NASA user. It should contain updated versions of the items in the Software Product Baseline, with corrections for nonconformance found during the acceptance process.

2.1.13. Software Usage Agreement (SUA) is a legal document issued by NASA and signed by a software requester to allow the requester to receive the requested software. A SUA must be signed or otherwise agreed to by the recipient to allow the recipient to receive the requested software. A SUA will, at a minimum, include a Software Release Record as defined in paragraph 2.1.14 and 3.9.1, the disclaimer and indemnification provisions of paragraph 3.8.4 and the notices of paragraph 3.8.5, and may also include provisions for nondisclosure and export control as required. An SUA should also specify any restrictions on use and disclosure of said software imposed by NASA on the recipient. An SUA should be issued for every software released in accordance with NPD 2210.1 and this NPR by a Software Release Authority, and an original SUA, signed by the recipient, should be retained by the Software Release Authority, or designee. The SUA needs to be filed in a system of records and maintained for disposition per guidance provided in NPD 1440.6 and NPR 1441.1.

2.1.14. Software Release Record is the method by which the external release of NASA software will be recorded. A release record must contain the recipient's name, address, phone number, e-mail address, date of transfer, and version of software transferred.

2.2.1. The release terminologies defined in Section 2.2 are not intended to be the exclusive methods of releasing software. Generally, software will be either releasable without a nondisclosure agreement, releasable with a nondisclosure agreement, releasable for U.S. Government purposes, or not releasable as determined by the Patent or Intellectual Property Counsel in paragraph 3.4.4. The release options identified in paragraphs 2.2.2 through 2.2.5 constitute a hierarchy from least to most restrictive. Once a particular release category has been approved, software may be released under that category or under any of the more restrictive release categories. Additional specific release restrictions are identified in Section 3.8.

2.2.2. "Approved for General Public Release" - This release category is the broadest release category possible and may be approved only if Software Accepted (As-Built) Baseline has been categorized as Publicly Releasible Software as defined in paragraph 2.1.7. This release category indicates there are no export restrictions on the software and should be approved with great care and requires concurrence by Agency Export Control officials. Once software has been Approved for General Public Release, all other release types could be allowed; however some may be inappropriate, e.g., if no further development is envisioned, then a Beta Release would be inappropriate. This type of release also meets the requirements of open source software as defined by the Open Source Initiative. Either an SUA or an Open Source license is required.

2.2.3. "Approved for U.S. and Foreign Release" - This release category authorizes what is essentially a General U.S. Release, as defined in paragraph 2.2.4, with additional availability to foreign persons, as defined at 22 CFR 120.16. Due to Agency policy reflected in NPD 2110.1, Foreign Access to NASA Technology Transfer Materials, this category should be approved only for "Software Accepted (As-Built) Baseline" that may have special considerations, such as public health and safety benefits, or where special circumstances accrue economic benefit to the U.S. This release category should be approved with great care and requires concurrence by Agency Export Control officials. A SUA is required and appropriate non- disclosure provisions may be included.

2.2.4. "Approved for General U.S. Release Only" - This release category authorizes the release of Software Accepted (As-Built) Baseline for use by U.S persons only. It does not remove Export Control Program restrictions. Normally, this release category does not allow further transfer of the software by the recipient without the prior written approval of NASA. An SUA is required and appropriate nondisclosure and export control provisions may be included.

2.2.5. "Approved for U.S. Government Purpose Release" - This large, but restrictive, release category includes five subcategories. An SUA is required and appropriate nondisclosure and export control provisions may be included. The following subcategories are included under this release category.

2.2.5.1. "Approved for Beta Release" - A limited release of the Software Code Baseline for Government purposes of acquiring evaluation comments and feedback.

2.2.5.2. "Approved for Project Release" - Any release of the Software Product Baseline or the Software Accepted (As-Built) Baseline to be used on behalf of the U.S. Government. A project Release is appropriate in the following situations:

a. On NASA contracts or grants;

b. In the United States on a Space Act agreement, cooperative project, exchange program, or other agreement between NASA and another organization; or

c. By a foreign organization if determined by NASA to be required to implement an international cooperative project established by NASA in an international agreement with the foreign cooperating or sponsoring agency. Any transfer must be in accordance with the international agreement and the NASA Export Control Program.

2.2.5.3. "Approved for Developmental Release" - A release of the Software Product Baseline specifically for further development on behalf of the Government and not including operational use.

2.2.5.4. "Approved for Interagency Release" - A release of any software for use by another U.S. Government agency.

2.2.5.5. "Approved for NASA Release" - A release of any software for use by NASA personnel and NASA contractors only.

2.2.5.5.1. "NASA Remote Access" - A granting of access to NASA computers and associated software to those acting on behalf of NASA for Government purposes.

2.2.6. "Unrestricted Release" - The unrestricted access to, or distribution of, software, including electronic transmission, to an individual or organization outside NASA or its contractors or grantees, without identifying the recipient or establishing a release record. This type of release is not allowed by Agency policy.

3.2.1. The Center Software Release Authority will ensure that software subject to NPD 2210.1 and this NPR is reported (in compliance with NPD 2091.1 for NASA employees, and the Patent Rights or New Technology clauses for NASA contractors and grantees) and inventoried prior to any external release. The NASATechTracS Information System shall be used for these purposes.

3.2.2. The Software Release Authority may establish supplemental guidance in support of NPD 2210.1 and this NPR to determine the applicability of NPD 2210.1 to software funded by the Center, and to otherwise administer the implementation of NPD 2210.1 and this NPR.

3.2.3. Software subject to NPD 2210.1 and this NPR, as described in Section P.2 and as determined by the Center Software Release Authority under paragraph 1.2.1.6, must be formally reported to NASA prior to any release. In accordance with paragraph P.2.c, new software is subject to NPD 2210.1 and this NPR. A merely trivial variation or improvement of preexisting software includes minor code improvements that do not materially alter the software's operation. Thus, this reporting requirement applies to new software that has not yet been reported, and to software reported under NPD 2210.1 where new functionality has been added to the software since it was reported. This reporting requirement applies to software submitted and accepted into NASA's Agency inventory prior to the effective date of NPD 2210.1, dated October 17, 1997, only if such software has been modified by more than a merely trivial variation or improvement thereof by a NASA employee or a NASA contractor. The Agency inventory means official repositories that exist currently or may have previously existed such as the Computer Software Management and Information Center (COSMIC).

3.2.4. Although a grant is an inappropriate instrument for developing software for NASA, where a grantee has developed software as a consequence of performing activities under a grant, the grantee should report the software as a potentially patentable software-related invention.

3.2.5. In accordance with NPD 2091.1, Government employee-created software will be reported by the software's creator to the Center Patent or Intellectual Property Counsel or, if no Patent or Intellectual Property Counsel is assigned, to the Center personnel designated to receive invention disclosures. Contractors will report software created by their employees or subcontractors to the NASA New Technology Representative named in the contract. The NASA New Technology Representative will provide the Center Patent or Intellectual Property Counsel with copies of contractor reports disclosing software. Government employees will report software on NASA Form (NF) 1679 "Disclosure of Invention and New Technology (Including Software)." Contractors may report software on NF 1679 or on their own New Technology Reporting form. However, contractor reports shall at least include information equivalent to that disclosed in NF 1679. Reports must be filed and maintained in a system of records and safeguarded until disposition per guidance provided in NPR 1441.1. In addition, all software disclosures must:

a. Identify the individuals contributing to the concept expressed by the software (i.e., the underlying functional method or process that is implemented by the software) as well as those individuals involved in coding the actual software;

b. Indicate where the software is an improvement or innovation;

c. Identify any proprietary source code or object code that is incorporated into the software and is owned by a non-federal entity;

d. Indicate whether a license has been obtained in situations where source code or object code owned by a non-federal entity has been incorporated into the software; and,

e. Indicate whether any known export restrictions apply to the software.

3.4.1. The Center Patent or Intellectual Property Counsel will make an Intellectual Property Assessment of all reported software to determine NASA's rights in the software, to identify any appropriate release restrictions as defined in paragraphs 3.4.4.1 to 3.4.4.4, and to determine the suitability of software for patent and/or copyright protection.

3.4.2. The Center Patent or Intellectual Property Counsel will determine the suitability of software for patent and/or copyright protection.

3.4.2.1. The Center Patent or Intellectual Property Counsel will identify the authors and inventors of software. Accordingly, individuals contributing to the concept expressed by the software (i.e., the underlying functional method or process that is implemented by the software) must be identified as well as those individuals involved in coding the actual software or software modification.

3.4.2.2. The Center Patent or Intellectual Property Counsel will review the software to see if it satisfies the criteria for patentable subject matter and whether or not it is a work of the U.S. Government as defined in paragraph 3.4.3.2. The underlying functional concepts and/or ideas in software may be protected through patenting, whereas the actual software code created, expressing those concepts, may be protected through copyright.

3.4.3. The Center Patent or Intellectual Property Counsel will determine ownership of software for purposes of obtaining patent and/or copyright protection as well as for assessing NASA's right to release the software. Determination of ownership and patent and/or copyright protection will facilitate licensing and distribution of the software.

3.4.3.1. Patents - NASA can obtain domestic and/or foreign patents on the ideas, algorithms and processes underlying the software if they satisfy the requirements for patentable subject matter. Normally, all parties must assign their interest in the software to the Government before NASA will file a patent application. If patentable subject matter is found and a patent application is filed, the U.S. Patent and Trademark Office will provide a license for foreign exporting and filing under 37 C.F.R. Part 5, if appropriate, for the purpose of filing foreign patent applications.

3.4.3.2. Copyrights - Software created solely by an officer or employee of the U. S. Government as part of that person's official duties is a work of the U. S. Government. Copyright protection is not currently available in the United States for a work of the U. S. Government. However, the Government can claim foreign copyrights for software created by its employees and can receive and hold copyrights transferred to it by assignment.

3.4.3.2.1. NASA can direct its contractors to assert their copyright and assign it to the U.S. Government when software is created under a NASA contract. If the contractor provides an acceptable plan to commercialize the software and the Contracting Officer, in consultation with the Center Patent or Intellectual Property Counsel, provides the contractor written permission to assert copyright in the software code, the contractor may retain the copyright with the Government retaining a license for use by and for the Government. This license does not, however, include the right to distribute the software to the public.

3.4.3.2.2. Software that is a joint work between NASA employees and NASA contractors is protected under copyright and, absent an agreement to the contrary, is co-owned by the U.S. Government and the contractor, with each having an independent right to use or license the use of the work with an obligation to account for royalties.

3.4.4. Center Patent or Intellectual Property Counsel will identify software as falling under one or more of the categories listed in the following subparagraphs. As circumstances change, the Center Patent or Intellectual Property Counsel may reevaluate and recategorize the software as appropriate.

3.4.4.1. Releasable Without a Nondisclosure Agreement - Software that has been categorized as Approved for General Public Release and becomes Publicly Releasable Software as defined in paragraph 2.1.7 is releasable without a nondisclosure agreement. Software that has not been categorized as Approved for General Public Release but (a) is a work of the U.S. Government as defined in paragraph 3.4.3.2, (b) is not export restricted, (c) is not, and is not expected to be, the subject of a patent application, and (d) for which there is no plan for further development or beta testing, may be released without a nondisclosure agreement. This type of release should be used with caution to avoid creating a statutory bar to patenting.

3.4.4.2. Releasable With a Nondisclosure Agreement - In general, software, as valuable property, is not an agency record under the Freedom of Information Act (FOIA), and therefore is not subject to the mandatory disclosure provisions of the FOIA. Thus, with limited exceptions, software may be categorized as releasable with a nondisclosure agreement. The limited exceptions include software that (a) contains an embedded database that is itself releasable under the FOIA, (b) is so related to a releasable database that the database would be unintelligible or unusable without the software, and (c) preserves information relative to the Agency's structure, operation, or decision-making process. To avoid creating a statutory bar for patenting, software that is being reviewed by the Patent or Intellectual Property Counsel for patentable subject matter and the filing of a patent application should be categorized as releasable with a nondisclosure agreement. Additionally, software that is part of an application for patent filed in the U. S. Patent and Trademark Office, or with any foreign patent office, may be categorized as releasable with a nondisclosure agreement.

3.4.4.3. Releasable for U.S. Government Purposes - Software that has U.S. Government purpose only restrictions on use, copying, distribution, etc., may be categorized as releasable for U.S. Government purposes only. A U.S. Government purpose is any activity in which the U. S. Government is a party, including contracts, grants, and cooperative agreements. Government purposes include competitive procurements for the Government, but do not include the rights to use, modify, reproduce, release, perform, display, or disclose a copyright work for commercial purposes or authorize others to do so. Thus, the Government may release or disclose such software outside the government and authorize persons to whom release or disclosure has been made to use, modify, reproduce, release, perform, display, or disclose the software for Government purposes only.

3.4.4.4. Not Releasable - Software owned by a non-federal party shall be categorized as generally not releasable unless permission is granted by its owner. Software in the lawful possession of NASA that includes restrictions on further use, duplication, or disclosure based on an underlying contract, license, or other agreement shall be categorized as not releasable unless permission is granted by its owner. Even with such permission, an export control assessment in accordance with Section 3.6 is required if the proposed release is to a foreign person.

3.4.4.5. Licensable Software - Software categorized as Licensable Software, as defined in Section 2.1, shall be consistent with commercialization objectives and shall be coordinated with the Manager for Technology Transfer Office, or designee.

3.4.4.5.1. The licensing of software that is the subject of a patent or patent application owned by the Government is governed by the Department of Commerce regulations (37 C.F.R. Part 404) on Licensing of Government-Owned Inventions. The licensing of copyrights owned by the Government is not covered under any existing-licensing regulations. However, it is NASA policy that, after NASA has provided public notice of the availability of software for licensing, software copyrights owned by the Government may be licensed on a nonexclusive, exclusive, or partially exclusive basis in a manner similar to that specified in the Department of Commerce regulations on Licensing of Government-Owned Inventions.

3.4.4.5.2. Royalty Sharing - In accordance with NPD 2092.1, all royalties received by NASA Centers from the licensing of software will be forwarded to the Office of the General Counsel (Code GP), NASA Headquarters. The Office of General Counsel will coordinate the distribution of royalties with the Office of the Chief Financial Officer, NASA Headquarters. Royalties received by NASA from the licensing of software that is the subject of a patent or a patent application may be distributed as prescribed in NPD 2092.1 and NPR 2092.1. Other royalties received by NASA from the licensing of software, absent statutory authority, must be forwarded by NASA Headquarters to the U. S. Treasury.

3.5.1. The Manager for Technology Transfer, or designee, will coordinate an assessment of reported software's technology transfer readiness and potential. The assessment will consider the software's value or utility to potential private or public sector users and applications outside of NASA.

3.5.2. External individuals or organizations and NASA contractors, grantees, and Space Act Agreement partners with whom NASA has nondisclosure arrangements, may provide research and analysis in support of the assessment. The disclosure of NASA-funded software to such individuals and organizations should be conducted as part of the NASA decisionmaking process for NPD 2210.1 and this NPR, and should provide protection against the unintended public release of NASA-funded software.

3.5.3. The assessment should include strategies and recommendations for the transfer of the software which will maximize its benefit to NASA, the U.S. public, and the U.S. economy.

3.6.1. The Center Export Administrator will coordinate a review of reported software when required to determine export control requirements, and will provide guidance and oversight to ensure that any intended foreign release of software (including a release into the public domain) complies with applicable export control laws and the NASA Export Control Program. While this assessment is only required for releases that legally constitute exports, it may be requested and used for decisionmaking by the Software Release Authority in determining appropriate categorization and availability for release in other situations. The Center Export Administrator will ensure that any intended foreign release of NASA software will comply with (1) the U.S. State Department regulations for software falling within the purview of the United States Munitions List, or (2) the U.S. Department of Commerce regulations for software falling within the jurisdiction of the Department of Commerce.

3.6.2. All requests for the external release of command & control (C&C) software for flight operations must have the endorsement of the NASA Center officials with management responsibility for development, acquisition, and implementation of the requested C&C software.

3.6.3. All requests for the external release of C&C software are subject to the Export Control Assessment established by NPD 2210.1 and this NPR. The Center Counter-Intelligence official will be consulted as part of the export control assessment of C&C software.

3.6.4. During the Export Control Assessment of C&C software considered for release, the Center Export Administrator, as warranted, will consult with the Center Inspector General's Office.

3.6.5. Applicability - The export control laws cover the export of software outside the United States but do not cover domestic release of software unless the release is to a foreign person in the United States or to persons on U.S. sanctioned- or denied-parties lists. Therefore, a Beta Release or Developmental Release to a United States citizen in the United States is generally not an export. A release to a foreign person in the United States or abroad or public access to software on the Internet are both considered an export. A General Public Release, as described in paragraph 2.2.2, is always considered an export due to its availability to any foreign entity. A release must be limited to a U.S. person as defined in 22 CFR 120.15 and not appearing on any U.S. sanctioned- or denied-parties lists unless approval to export the software has first been obtained by the Center Export Administrator. Additionally, any software that is being exported should prominently display appropriate Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) legends, if the software has been determined to be export controlled by the Center Export Administrator.

3.6.6. Foreign Release - The decision to support a foreign release or export is made by the Software Release Authority in consultation with a cognizant program official. An affirmative decision to allow a foreign release or export requires that the designated Center Export Administrator become involved to determine the proper manner to export the software.

3.6.7. Unauthorized Foreign Release - An employee who makes a foreign release without authorization risks violating the EAR or the ITAR, which may result in criminal, civil, or administrative action against both the Agency and the employee.

3.7.1. The Center ITSM will advise and assist the Center SRA and the cognizant software development and assurance organizations in the identification and the mitigation or elimination of information technology security risks associated with the external release of software considered within the scope and purpose of NPD 2210 and this NPG. A key objective of Center ITSM advice and assistance is to ensure the integrity of NASA information technology systems and to prevent unauthorized access to NASA computing resources.

3.7.2. The PCITS guidance shall include a standard checklist or specific criteria for use by the Center SRA and/or the cognizant software development and assurance organizations in performing an IT security assessment of all software considered for external release.

3.7.3. If the PCITS guidance requires interpretation in its application, the Center SRA or the cognizant software development and assurance organizations shall consult with their Center ITSM to provide clarification. Software that is modified to mitigate or eliminate identified IT Security risks prior to its release shall be re-assessed upon the documented completion of risk reduction measures.

3.7.4. The results of the IT security assessment of the software considered for external release shall be documented by the software development organization and provided to the Center SRA for use in determining the release of software in accordance with the PCITS guidance. A copy of the assessment results shall be provided to the Center ITSM. The Center SRA and the Center ITSM, as deemed warranted by either party, shall jointly consider a given IT security assessment prior to the release of the subject software.

3.8.1. The Software Release Authority is responsible for ensuring that the external release of applicable software created by and for the Center is accomplished in accordance with NPD 2210.1 and this NPR. Accordingly, the Software Release Authority will consider recommendations and determinations resulting from Sections 3.4 through 3.7 and programmatic objectives in establishing the release restrictions and the approved option(s) for releasing the specified software.

3.8.2. Release Restrictions - The Software Release Authority is authorized to release software more restrictively than determined by Center Patent or Intellectual Property Counsel and the Center Export Administrator. However, in no event will the Software Release Authority release software less restrictively than determined by Center Patent or Intellectual Property Counsel in paragraphs 3.4.4.1 through 3.4.4.4, by the Center Export Administrator in Section 3.6, or by the Center ITSM in Section 3.7. Upon consulting with the Software Innovator where necessary, the Software Release Authority has the authority to categorize software as Software Code Baseline, Software Product Baseline, Software Accepted (As Built) Baseline or Publicly Releasable Software as those terms are defined in Section 2.1. The Center Patent or Intellectual Property Counsel has the authority to categorize software as Licensable Software as defined in Section 2.1. The following specific release restrictions may apply to any of the release options, as follows:

a. The Software Release Authority may authorize a Beta Release, as defined in paragraph 2.2.5.1, only upon NASA's receipt and acceptance of nondisclosure and feedback agreements. A Beta Release is only appropriate for the purpose of obtaining test and evaluation comments and feedback on the operation of a computer program from beta release recipients. A Beta Release to a foreign organization, consistent with paragraphs 2.2.5.2 and 3.8.3.c, may be authorized by the Software Release Authority in consultation with the Center Export Administrator.

b. The Software Release Authority may authorize a Project Release, as defined in paragraph 2.2.5.2, only through written contract or agreement that includes appropriate nondisclosure provisions. At a minimum, NASA should obtain Government purpose license rights to any software enhancements or derivative works made by a recipient of a developmental release.

c. The Software Release Authority may not authorize an Unrestricted Release as defined in paragraph 2.2.6.

3.8.3. The Software Release Authority will identify, consistent with the established release restrictions, the approved options for releasing specified software as defined in Section 2.2. In addition to the release restrictions identified in Section 2.2, the following restrictions apply to the specified release options:

a. Project Release, as defined in paragraph 2.2.5.2, for NASA contracts or grants - The release must specifically limit the use of the software to the contractor and specifically identified subcontractors, solely to accomplish the work described in the contract or grant. Upon approval by the Software Release Authority, the release may be implemented by the cognizant technical project monitor and may be made before the Intellectual Property Assessment is completed under an appropriate nondisclosure agreement. Nondisclosure agreements and/or export licenses are required when needed.

b. Project Release, as defined in paragraph 2.2.5.2, for use in the United States with a Space Act Agreement, cooperative project, exchange program, or other agreement between NASA and another organization - The release must specifically limit the use of the software to the stated recipient, solely to accomplish the work described in the agreement, or if further distribution is approved, delineate any NASA-approved distribution of the released software.

c. Project Release, as defined in paragraph 2.2.5.2, for use by a foreign organization to implement an international cooperative project established by NASA in a project agreement with the foreign cooperating or sponsoring agency - the release must specifically limit the use of the software to the stated recipient and must prohibit any further distribution.

d. Patent and copyright licensing to external entities - The licensing strategy (e.g., nonexclusive, exclusive, partially exclusive) will be determined by the Manager for Technology Transfer, or designee, in consultation with the Center Patent or Intellectual Property Counsel.

e. General U.S. Release, as defined in paragraph 2.2.4, to external individuals and organizations may be made by the Center directly, or by the Center via a designated NASA agent for software transfer and distribution (i.e., NASA contractor, grantee or Space Act Agreement partner). A General U.S. Release via a designated agent is subject to NPD 2210.1 and this NPG. Restrictions on the use and distribution of software via a designated agent may be established by NASA.

3.8.4. Disclaimer and Indemnification - All software released by NASA shall contain appropriate disclaimer and indemnification provisions stating that the software is provided without any warranty, expressed or implied, and that the recipient waives any claims against, and indemnifies and holds harmless, the Government and its contractors and subcontractors. The disclaimer and indemnification provisions should be included in the SUA and, where practicable, should be displayed on software startup and/or be attached as a label to the software medium released. Sample provisions are provided, as follows:

a. This software is provided "as is" without any warranty of any kind, either expressed, implied, or statutory, including, but not limited to, any warranty that the software will conform to specifications, any implied warranties of merchantability, fitness for a particular purpose, or freedom from infringement, any warranty that the software will be error free, or any warranty that documentation, if provided, will conform to the software. In no event shall the U.S. Government, or the U.S. Government's contractors or subcontractors, be liable for any damages, including, but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this software, whether or not based upon warranty, contract, tort, or otherwise, whether or not injury was sustained by persons or property or otherwise, and whether or not loss was sustained from, or arose out of the results of, or use of, the software or services provided hereunder.

b. Recipient agrees to waive any and all claims against the U.S. Government, and the U.S. Government's contractors and subcontractors, and shall indemnify and hold harmless the U.S. Government, and the U.S. Government's contractors and subcontractors, for any damage that recipient may incur from recipient's prior or future use of the provided software, including any damages from products based on, or resulting from, the use thereof.

c. If further release or distribution of this software or technical data derived from this software is permitted, recipient agrees to obtain this identical disclaimer of warranty agreement and waiver of claims, indemnification and hold harmless agreement with any entities that receive the software or technical data derived from the software.

3.8.5. Notices

3.8.5.1. Copyright Notice - As app , ropriate, software released by NASA shall contain a copyright notice as follows: "Copyright [or "] (if published: year of first publication; if unpublished: Unpublished--all rights reserved) U. S. Government as represented by the Administrator of the National Aeronautics and Space Administration [or the name of any non-federal owner of the copyright that has granted NASA the right to release the software]."

3.8.5.1.2. Software identified as a work of the U. S. Government, as defined in paragraph 3.4.3.2, shall contain the following additional language: "No copyright is claimed in the United States under Title 17, U.S. Code."

3.8.5.2. Restrictive Notice Software released under disclosure or other restrictions shall contain an appropriate notice specifying such restrictions. An example provision is provided, as follows:

"This software may be used, copied, and provided to others only as permitted under the terms of the contract or other agreement under which it was acquired from the U.S. Government. Neither title to nor ownership of the software is hereby transferred. This notice shall remain on all copies of the software."

3.9.1. Release Records - The Software Release Authority is responsible for establishing and maintaining release records. The unrestricted release of NASA software (i.e., without a release record) is prohibited. If the release is solely by electronic means, an Internet Protocol Address, by itself, is insufficient for identification purposes. An archive copy of the Software Code Baseline, the Software Product Baseline and the Software Accepted (As-Built) Baseline must be maintained at the Center. An unidentified release of NASA software does not provide NASA with the ability to measure the interest generated by the software or track the owner of a particular version of the software. Release Records will be safeguarded, maintained, and disposed of per guidance provided in NPR 1441.1.

3.9.2. The performance measures or metrics, as established by NPD 2210.1, will be reported semiannually (due 2 weeks following the end of 2nd and 4th fiscal year quarters) by the Center SRA to the Director, Innovative Technology Transfer Partnerships Division at NASA Headquarters. To the extent feasible, the NASA TechTracS Information system will be used to record and maintain metrics data.