Procedural
Requirements
Effective Date: June 14, 2023
Expiration Date: June 14, 2028
|
|
NASA Procedural Requirements |
NPR 2210.1E Effective Date: June 14, 2023 Expiration Date: June 14, 2028 |
| | TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | ALL | |
2.1.1 NASA has standardized its process for review and release of NASA software through the NTTS Software Release System (SRS). All reviews described below are facilitated and tracked by the SRA through the SRS at softwarerelease.ndc.nasa.gov. This process is initiated with the filing of an invention disclosure through the electronic New Technology Reporting system (e-NTR) at invention.nasa.gov.
2.1.2 The SRA shall conduct awareness activities and orientation sessions for Center civil servants and contractors to support the implementation of this NPR.
2.2.1 Software subject to this NPR, as described in paragraph P.2 and as determined by the SRA under paragraph 1.10, shall be reported to NASA.
2.2.1.1 The SRA shall ensure that software is reported in accordance with this section 2.2 and is inventoried in the NTTS.
2.2.2 This reporting requirement applies to new software subject to this NPR that has not yet been reported and to software previously reported where new functionality or new innovators have been added to the software since it was reported.
2.2.3 Except for an Approved for Intra-NASA Release as defined in 3.2.5.7, software will be reported prior to any release.
2.2.3.1 To minimize delays during software development or review among NASA Centers, if approved by the SRA, after consultation with Center Patent or IP Counsel, software released as an Approved for NASA Release may be reported in a timely manner after the release.
2.2.4 In accordance with NPD 2091.1, Inventions Made By Government Employees, each NASA employee who makes an invention embodied by software is required to report such invention to the personnel responsible for assisting in the reporting of inventions. Contributors can be included on the same invention disclosures.
2.2.5 In accordance with the Patent Rights or New Technology clauses in NASA contracts and other agreements, contractors, subcontractors, and other agreement recipients shall report subject inventions and reportable items that include software created by their employees to the NASA New Technology Representative named in their contracts.
2.2.6 NASA does not use grants to obtain software deliverables. In cases where software deliverables are produced and delivered to NASA, NPR 2210.1 only applies to a NASA release of the software produced by a grantee.
2.2.7 Software is normally reported using the NASA electronic New Technology Reporting system (e-NTR) located at https://invention.nasa.gov.
2.3.1 The SRA shall coordinate the review and assessment of reported software by the Patent or IP Counsel as described in Section 2.4, the Center official designated by the Center Director, or his/her designee(s), as described in Section 2.5, the CEA as described in Section 2.6, and the CISO as described in Section 2.7.
2.3.2 The software developer(s) shall complete the Software Release Request authorization (SRRA) checklist, Compliance Matrices for Software Classification, and 508 Compliance Certification in NTTS.
2.4.1 The Patent or IP Counsel shall provide appropriate legal counsel with respect to an Intellectual Property and Releasability Rights Assessment of all reported software to determine NASA's rights in the software, to determine the suitability of software for patent and/or copyright protection, and to identify any appropriate transfer restrictions.
2.4.2 The Patent or IP Counsel shall provide appropriate legal counsel with respect to the Government's rights in software for the purposes of assessing NASA's right to release the software. Determination of the Government's rights is required before the software may be released.
2.4.2.1 To release the software, the Government must have clear rights to release the software, such as an ownership interest, a Government purpose license, or other appropriate license or permission from third-party owners. If the reported software does not include any proprietary software or software owned by a Non-Federal entity, or the Government has a license/permission to use any such software included in the reported software (e.g. Government Purpose or Open-Source license), the software may, at its most restrictive, be accepted as Approved for U.S. Government Purpose Release. Centers, however, should still explore whether a broader release category is permitted.
2.4.2.2 Where it is known that open-source software, as defined in Appendix A, is included in software proposed for release, the Patent or IP Counsel shall prior to any release:
a. Review the external open-source software license and assess any special risks that may be involved.
b. Confirm that NASA has obtained clear rights from any third-party rights owners, such as through an assignment or license.
2.4.2.3 When it is known that Open-Source Software Development may be used as part of a NASA project, the Office or Project that has responsibility for acquisition or development of the software, in consultation with Center Patent or IP Counsel, shall assess any risks that may negatively impact NASA's intended use.
2.4.3 The Patent or IP Counsel shall provide appropriate legal counsel for determining the suitability of reported software for patent and/or copyright protection.
2.4.3.1 The Patent or IP Counsel shall provide appropriate legal counsel in the determination of authors and inventors of software and whether:
(1) The software qualifies as patentable subject matter.
(2) Is a work of the U.S. Government. The software invention, e.g., the underlying functional concepts and/or ideas implemented by the software, may be protected through patenting, whereas the actual software code, which expresses those concepts, may also be protected through copyright.
2.4.3.2 Patents. NASA can obtain domestic and/or foreign patents on the ideas, algorithms, and processes underlying the software if they satisfy the requirements for patentable subject matter. Normally, all parties with an ownership interest assign their interest in the software to the Government before NASA files a patent application. Consistent with guidelines set forth in NPR 7500.2, NASA Technology Transfer Requirements, patents will only be sought when a clear determination has been made that patent protection would be a more effective method of ensuring broad distribution and adoption of the technology than the conventional Software Release Process.
2.4.3.3 Copyrights. Software created solely by an officer or employee of the U. S. Government as part of that person's official duties is the work of the U. S. Government. Copyright protection is not currently available in the U.S. for a work of the U. S. Government. However, the Government can claim foreign copyrights for software created by its employees and can receive and hold U.S. and foreign copyrights transferred to it by assignment.
2.4.3.4 Prior to release, under contracts that include the NASA FAR Supplement 1852.227-14, Rights in Data--General Clause, NASA Contracting Officers can direct its contractors to assert their worldwide (U.S. and foreign) copyright and assign it to the U.S. Government when software is created under a NASA contract. Alternatively, where written Contracting Officer permission to assert and retain ownership of copyright has been provided to a contractor, the contractor retains the copyright with the Government retaining a license for use by and for the Government. However, this Government purpose license does not include the right to distribute the software to the public. Such software may be distributed for Government purposes as defined in paragraph 2.4.4.3, unless a broader license has been obtained by the Government.
2.4.4 Patent or IP Counsel shall provide appropriate legal counsel with respect to evaluating and classifying reported software under one or more of the categories listed in the following subparagraphs. As circumstances change, the software may be reevaluated and reclassified.
2.4.4.1 After review, software determined to be Approved for Public Release or Approved for Open-Source Release is releasable without nondisclosure obligations in the SUA. Software that has not been categorized as Approved for Public Release or Approved for Open-Source Release, but (a) is a work of the U.S. Government as defined in paragraph 2.4.4.3, (b) is not export restricted, and (c) is not, and is not expected to be, the subject of a patent application, may be released without nondisclosure obligations in the SUA. This type of release will be used with caution to avoid creating a statutory bar to patenting.
2.4.4.2 In general, software, as valuable property, is not an Agency record under the FOIA, and, therefore, is not subject to the mandatory disclosure provisions of the FOIA. Thus, with limited exceptions, software may be generally categorized as releasable with nondisclosure obligations. The limited exceptions include software that:
(1) Contains an embedded computer database that is itself releasable under the FOIA.
(2) Is so related to a releasable computer database that the computer database would be unintelligible or unusable without the software.
(3) Preserves information relative to the Agency's structure, operation, or decision-making process.
a. To avoid creating a statutory bar for patenting, software that is being reviewed by the Patent or IP Counsel for patentable subject matter and the filing of a patent application shall be categorized as releasable with nondisclosure obligations.
b. Additionally, software that is part of an application for patent filed in the U. S. Patent and Trademark Office, or with any foreign patent office, shall be categorized as releasable with nondisclosure obligations.
c. Software categorized as Releasable with Nondisclosure Obligations will include nondisclosure provisions in the SUA when released.
2.4.4.3 Releasable Only for U.S. Government Purposes. Software that has U.S. Government purpose only restrictions on use, copying, distribution, etc., should be categorized as Releasable Only for U.S. Government Purposes.
a. Software so categorized should be used only for U.S. Government purposes. For purposes of this NPR, a U.S. Government purpose is any activity carried out by or on behalf of, the U.S. Government. Consult Center or HQ Patent or IP attorneys with any questions regarding whether an activity is a Government purpose.
b. Government purposes include a release for use in competitive procurements for the Government, but do not include a release for commercial purposes or a release to the public. Thus, the Government may release or disclose such software outside the Government and authorize persons to whom release or disclosure has been made to use, modify, reproduce, release, perform, display, or disclose the software for Government purposes only.
c. Patent or IP Counsel shall determine whether nondisclosure provisions should be included in an SUA for release of software categorized as Releasable Only for U.S. Government Purpose.
2.4.4.4 Not Releasable. This category includes software in which the associated copyright is owned by a non-Federal party. Software in the lawful possession of NASA that was obtained under a contract, license, or other agreement that prohibits any further use, duplication, or disclosure, will be categorized as Not Releasable; and, unless subsequent permission is granted by its owner, such software should not be released. Even with such permission, an export control assessment in accordance with paragraph 2.6 is required if the proposed release is to a foreign person.
2.4.4.5 Licensable Software. Software categorized as Licensable Software, will be consistent with technology transfer objectives and should be coordinated with Patent or IP Counsel and the Center official designated by the Center Director, or his/her designee(s).
a. The licensing of software is governed by Government-wide licensing regulations (37 CFR Part 404, Licensing of Government Owned Inventions) or NPD 2090.6, Authority to Enter Into License Agreements and Implementation of Licensing Authority.
b. While the licensing of software under NPD 2090.6 is not a release under this NPR, before Licensable Software is approved for licensing and release, the software will receive the same review and assessment process described in this chapter.
2.5.1 The organization designated by the Technology Transfer Program Executive, or designee, shall coordinate an assessment of any reported software's technology transfer potential.
2.5.1.1 The assessment should consider the software's value or utility to potential private or public sector users and applications outside of NASA. Section 4.1 of NPR 7500.2, NASA Technology Transfer Requirements, provides guidance on providing assessments of technical transfer potential.
2.5.2 External individuals or organizations and NASA contractors, grantees, and Space Act Agreement partners, with whom NASA has nondisclosure arrangements to protect against the unintended public release of NASA-funded software, may provide research and analysis in support of the Technology Transfer Assessment.
2.5.3 The assessment will include strategies and recommendations for the transfer of the software which will maximize its benefit to NASA, the U.S. public, and the U.S. economy.
2.5.4 Upon approval by the Center SRA after consultation with Center Patent or IP Counsel, a Project Release for use under a NASA contract may be made prior to a Technology Transfer Assessment (see also 3.2.5.4.c).
2.6.1 The decision to support a foreign release of software (i.e., a release made directly to, or made accessible to, any individual outside of the U.S. or a foreign person in the U.S.) should be made by the SRA in consultation with the Office or Project that has responsibility for the software, the CEA and Center Patent or IP Counsel.
2.6.2 A foreign release of software may be made only if the CEA approves the release. Prior to approval of a foreign release, the CEA shall conduct an Export Control Assessment of software to determine export control requirements and will provide guidance and oversight to ensure that any intended foreign release of software complies with applicable export control laws and regulations as well as the NASA Export Control Program.
2.6.2.1 The CEA shall ensure that any intended foreign release of NASA software complies with:
a. The U.S. State Department's ITAR for software falling within the scope of the United States Munitions List.
b. The U.S. Department of Commerce's EAR for software falling within the scope of the Commerce Control List.
2.6.2.2 While an export control assessment is only required for a release that legally constitutes an export, it may be requested and used for decision making by the SRA in determining appropriate categorization and availability for release in other situations.
2.6.3 All requests for the release of command and control (C&C) software for flight operations will have the endorsement of the NASA Center and Program officials with management responsibility for development, acquisition, and implementation of the requested C&C software.
2.6.3.1 All requests for the release of C&C software are subject to the Export Control Assessment established by this NPR.
2.6.3.2 During the Export Control Assessment of C&C software considered for release, the CEA, as warranted, should consult with the Center Inspector General's Office.
2.6.4 Applicability - The export control laws cover the release of technical data, including software, outside the U.S. and the release of technical data, including software, to a foreign person in the U.S., to a U.S. person representing a foreign person, or to persons on U.S. sanctioned-parties or denied-parties lists (see NPR 2190.1).
2.6.4.1 A release of software to a foreign person located in the U.S. or abroad or broad access by the public (e.g., on the Internet) are all considered to be an export.
2.6.4.2 A Public Release or an Open-Source Release, as described in Appendix A is always considered an export due to its availability to any foreign person and thus requires CEA approval.
2.6.4.3 A U.S. and Foreign Release may be an export, depending on the recipient.
2.6.4.4 A release of export-controlled software will include the appropriate export determination and be limited to U.S. persons as defined in U.S. Person, 22 CFR 120.15, and parties not appearing on any U.S. sanctioned-parties or denied-parties lists unless approval to export the software has first been obtained by the CEA. Additionally, any software that is being exported will prominently display the appropriate controlled unclassified information category of export controlled (CUI/SP-EXPT), if the software has been determined to be export controlled by the CEA.
2.6.5 Unauthorized Foreign Release - An employee who releases export-controlled software without authorization risks violating the EAR or the ITAR, which may result in criminal, civil, or administrative action against both the Agency and the employee.
2.7.1 The CISO shall advise and assist the SRA and the responsible software development and assurance organizations in the identification and the mitigation or elimination of information technology security risks associated with the release of software considered within the scope and purpose of this NPR. A key objective of CISO advice and assistance is to ensure the integrity of NASA information technology systems and to prevent unauthorized access to NASA computing resources.
2.7.2 CISO guidance may include a standard checklist or specific criteria for use by the SRA and/or the responsible software development and assurance organizations in performing an IT security assessment of all software considered for release.
2.7.3 If the checklist requires interpretation in its application, the SRA or the responsible software development and assurance organizations will consult with their CISO to provide clarification.
2.7.3.1 Software that is modified to mitigate or eliminate identified IT security risks prior to its release should be reassessed upon the documented completion of risk reduction measures.
2.7.4 The results of the IT security assessment of the software considered for release shall be documented by the software development organization project manager, in accordance with NPD 7120.4, and provided to the SRA for use in determining the release of software.
2.7.4.1 A copy of the assessment results will be provided to the CISO. The SRA and the CISO should jointly consider a given IT security assessment prior to the release of the subject software.
2.8.1 The SRA shall ensure that the release of applicable software is accomplished in accordance with this NPR and metrics will be captured to monitor the efficient flow of the software packages through the release process.
2.8.2 When a release of NASA software is requested, the SRA shall consult with the Office or Project responsible for the software to determine a recommended release category.
2.8.3 In establishing release restrictions for specified software, the SRA shall consider Agency technology transfer objectives along with the recommendations and determinations resulting from the release assessments.
2.8.4 The SRA shall then identify, consistent with the established release restrictions, the approved option(s) for releasing specified software as implemented.
2.8.5 Finally, the SRA shall consult with the Patent or IP Attorney to determine the proper SUA for a release of NASA software. Model SUAs have been prepared and adopted for use by the SRAs. Model SUAs may be revised for a particular release only after consultation with the Center Patent or IP Counsel.
2.8.6 Except in the case of an Open-Source Release (see 3.2.2.2), an SUA will be signed, or otherwise agreed to, or acknowledged by the recipient before the requested software may be released to the recipient.
2.8.6.1 In the case of software where NASA seeks to expedite broad dissemination such as with a Public Release or an Open-Source Release, a recipient's agreement may be, for example, by click-wrap agreement or terms of use under the agreement. The SRA shall consult with the Patent or IP Attorney and the Office or Project to assess whether a proposed Public Release or Open-Source Release of NASA software raises sensitivities or potential liability given the breadth of access and the unrestricted distribution of the NASA software.
2.8.6.2 In the case of a Project Release under a Government contract, software may be released by NASA to U.S. Federal Government support service contractors as Government-Furnished Computer Software (GFCS) under the NASA FAR Supplement 1852.227-88 Government-Furnished Computer Software and Related Technical Data Clause included in their support service contract. In this instance, the contract clause and any additional Contracting Officer direction serve as the SUA. If software is to be released as GFCS, the SRA shall work with the applicable Contracting Officer and obtain sufficient information to document the release.
2.8.6.3 An SUA issued for any purpose other than an Open-Source Release will, at a minimum, include a Software Release Record described in section 3.5.1, the disclaimer and indemnification provisions, unless the latter is removed per guidance provided by Center Patent or IP Counsel, as required in section 3.3 and the notices of section 3.4 as required in this NPR and may also include provisions for nondisclosure and export control as required.
2.8.6.4 An SUA will also specify any restrictions on use and disclosure of said software imposed by NASA on the recipient.
2.8.6.5 For all releases other than an Intra-NASA Release, Open-Source Release or Public Release via click wrap agreement, an SUA will be issued by the SRA.
2.8.7 An SUA is a Government record and will be maintained in NTTS for disposition per guidance provided in NPD 1440.6, NASA Records Management, and NPR 1441.1.
| TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | ALL | |
| | NODIS Library | Legal Policies(2000s) | Search | |
This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.