Procedural
Requirements
Effective Date: June 14, 2023
Expiration Date: June 14, 2028
|
|
NASA Procedural Requirements |
NPR 2210.1E Effective Date: June 14, 2023 Expiration Date: June 14, 2028 |
| | TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | ALL | |
3.1.1 The release categories constitute a hierarchy from least to most restrictive. Once a particular release category has been approved, software may be released under that category or under any of the more restrictive release categories defined in section 3.2.
3.1.2 Generally, after consultation with the Patent or IP Counsel, an appropriate software release category is determined for software as described herein.
3.1.3 The SRA is authorized to release software with more restrictive conditions than recommended by the Patent or IP Counsel and the CEA, provided the SRA works with the Patent or IP Counsel to prepare the appropriate SUA. However, in no event will the SRA release software with less restrictive conditions than recommended by the Patent or IP Counsel in paragraphs 2.4.4.1 through 2.4.4.4 by the CEA in section 2.6, or by the CISO in section 2.7.
3.1.4 In keeping with the NASA Technology Transfer perspective in NPR 7500.2, which encourages and enables the widest possible utilization of NASA technological assets by public and private sectors of the U.S. to benefit the national economy and the U.S. Public, NASA-developed software should be released under appropriate release categories as determined by the requirements of this NPR.
3.1.5 Given that NASA is on the forefront of development and enhancement of systems to support human capital programs and processes and that NASA proactively shares such systems with the Federal community in support of the e-Government Act of 2002, 44 U.S.C., Chapter 36 and the Office of Management and Budget Human Resources Line of Business Initiative of 2008, NASA human capital software applications will generally be assigned release categories of Approved for Public Release, Approved for Open Source Release, or Approved for U.S. Government Purpose Release.
3.1.6 Center Software Release Authorities shall consult with Center Export Authorities when determining the appropriate software release category and processes applicable to software classified as export controlled under the EAR or ITAR regulations.
3.1.7 The release categories defined in 3.2 are not intended to be the exclusive methods of releasing software. Generally, software will either be releasable without a nondisclosure agreement, releasable with a nondisclosure agreement, or not releasable as determined by the Patent or IP Counsel.
3.2.1 Approved for Public Release.
3.2.1.1 This release category is the broadest release category possible.
3.2.1.2 Specific Release Requirements. In addition to the requirements associated with the categories identified in paragraphs 2.4.4.1 and 2.4.4.2, the specific requirements and restrictions in 3.2.1.3 to 3.2.1.9 apply to public release.
3.2.1.3 This release category indicates there are no export, nondisclosure, or other restrictions on the software and requires concurrence by the CEA and Center Patent or IP Counsel.
3.2.1.4 Once software has been approved for Public Release, all other release types may be allowed.
3.2.1.5 Software Approved for Public Release does not require a Technology Transfer Control Plan per section 3.5 of NPR 2190.1. Additionally, it is recognized that foreign entities may have access to Software Approved for Public Release.
3.2.1.6 Under this release category, further transfer of the software by the recipient without the prior written approval of NASA may be authorized.
3.2.1.7 All releases under this category, other than via a click-wrap agreement, require an SUA to be issued.
3.2.1.8 NASA protects and controls the use of its name, seal, insignia, and initials (see The NASA Seal and Other Devices, and the Congressional Space Medal of Honor, 14 CFR pt. 1221). Therefore, NASA software that is categorized as Approved for Public Release shall not include the name or initials of "NASA" in the software name or acronym.
3.2.1.9 Public or external mobile applications for distribution to the general public will have an Approved for Public Release determination.
3.2.2 Approved for Open-Source Release.
3.2.2.1 Open-Source Software, an alternate category to Publicly Releasable Software, developed by or for NASA shall be released under the NASA Open Source Agreement (NOSA), or if approved by Patent or IP Counsel, under another acceptable open-source license. In situations where external Open-Source Software under a different open-source license is incorporated into the NASA Open-Source Software (or vice versa), NASA may use the different open-source license if approved by Patent or IP Counsel. Restricted information such as ITAR, export control, or CUI will not be contributed to an Open-Source Software project.
a. A list of potentially acceptable licenses will be maintained by Center Patent or IP counsel.
b. Open-Source Software will not be released using a different open-source license, unless Patent or IP Counsel reviews the license to assess risks associated with its use and approves its use.
c. If a proposed release of Open-Source Software includes the release of external Open-Source Software, care will be taken to ensure that the pertinent license for such external Open-Source Software is acceptable.
3.2.2.2 When software categorized as Approved for Open-Source Release is released as Open-Source Software, the software recipient is provided with a copy of, or access to, the NOSA or other open-source license and the recipient's acceptance of the NOSA or other open-source license is effective upon download or use of the software. Thus, a signed SUA (e.g., a signed copy of the NOSA) is not required for this type of release.
3.2.2.3 NASA protects and controls the use of its name, seal, insignia, and initials (see 14 CFR pt. 1221). Therefore, NASA software that is categorized as Approved for Open-Source Release shall not include the name or initials of "NASA" in the software name or acronym.
3.2.2.4 Establishment of NASA-Controlled Open-Source Development Projects.
a. Closed NASA-Controlled Open-Source Projects. NASA employees may establish a closed repository NASA Open-Source Development Project for NASA software development. A closed repository is one where NASA controls and determines which entities receive access to software during development. The closed repository is used to host the open-source development project. To explore setting up a closed repository internal project, the Office or Project needs to contact the Center Software Release Authority and submit an invention disclosure covering the project software kernel via https://invention.nasa.gov. After the software kernel is approved for release to the project under the software release review process of this NPR, the software development team members may receive the software. A software development team may include civil servant team members, third-party team members, and contractor team members. In order to participate, civil servant team members shall sign acknowledgments, third-party team members (non-contracting entities) shall enter into SUAs (e.g., a Government Purpose Software Release), and contractors (the contracting entity, not its employees) shall either enter into an SUA or receive the software as Government-Furnished Computer Software under the terms of the contracting entity's contract with NASA. Thereafter, the software kernel may be freely shared among and developed by the project/mission team members during the course of the software development project. Software contributions from team members will be reviewed and incorporated into official NASA versions of the project software. Before incorporation, either individual third-party team members (or their employer) who contributed software need to enter into Contributor License Agreements or similar agreements to ensure NASA receives sufficient rights to use and release the software. Once developed, the resulting project software shall be reported and then reviewed and approved under the software release review process of this NPR before release by NASA. The review includes an analysis of rights, license compatibility, export, CUI, or similar issues that may need to be addressed before release. Future releases of the software by NASA shall also require review under this NPR.
b. Open NASA-Controlled Open-Source Projects. Open projects are hosted on open repositories where the public has access to the NASA software and can participate in the project. NASA employees can establish an open repository NASA Open-Source Development Project following the above process for closed projects, but only after a determination has been made that both the initial project/software contains no export-controlled information and the software developed is not expected to produce export-controlled information. Non-civil servant contributors shall enter into Contributor License Agreements or other similar agreement to ensure NASA receives sufficient rights to use and release the software. Other than bug fixes and minor enhancements, new versions containing software contributions shall require review under this NPR before release.
c. For potential open-source development at earlier software development stages than set forth above, Center Software Release Authorities shall consult with Patent/IP Counsel to determine whether an alternate open-source release strategy may be viable.
3.2.2.5 Contributions to qualifying Third-Party Open-Source Projects.
a. This NPR does not apply to contributions made by civil servants to a qualifying third-party open-source development project.
(1) Qualifying Open-Source Development Project. A qualifying open-source development project meets the following criteria:
(a) NASA does not own, control or manage the open-source development project and NASA participation therein is limited to that of any other member of the interested community;
(b) NASA will receive a recognized and articulated benefit from participation in the open-source development project.
(c) Each participating civil servant has obtained written permission from their supervisor acknowledging that participation in the open-source development project benefits NASA and is part of the participating civil servant's official duties.
(d) All code developed by the open-source development project is governed by an open-source license agreement that is approved by the Open Source Initiative.
(2) Contributions to a qualifying open-source development project are limited as follows:
(a) All code contributions by a civil servant shall be original.
(b) NASA's code contributions will be less than a majority of the overall code of the existing third-party project.
(c) All code contributions shall not contain export-controlled data, CUI, restricted computer software, or other type of data upon which restrictions are applicable.
(3) This exemption does not relieve a contributor from requirements imposed by other applicable statutes, regulations, and policies.
(4) Any other release by NASA of its code contribution is subject to the requirements of NPR 2210.
(5) In the event that a contributing civil servant is asked to sign a contributor license agreement or any other document associated with the qualifying open-source development project, advice from Center Intellectual Property Counsel shall be sought.
3.2.3 Approved for U.S. and Foreign Release.
3.2.3.1 Approved for U.S. and Foreign Release is essentially a U.S. Release where release can also be made to foreign persons.
3.2.3.2 Due to Agency policy supporting domestic benefit reflected in NPR 7500.2 (e.g., Section 5.2), this category will be approved for software having special considerations, such as public health and safety benefits, or where special circumstances accrue economic benefit to the U.S.
3.2.3.3 Normally, further transfer of the software by the recipient without the prior written approval of NASA is not allowed under this release category.
3.2.3.4 This release category requires concurrence by the CEA.
3.2.3.5 All releases under this category require an SUA.
3.2.3.6 Nondisclosure and export control provisions will be included as directed by the Patent or IP Counsel and CEA, respectively.
3.2.4 Approved for U.S. Release Only.
3.2.4.1 Normally, further transfer of software by the recipient without the prior written approval of NASA is not allowed under this release category.
3.2.4.2 All releases under this category require an SUA.
3.2.4 Nondisclosure and export control provisions will be included as directed by the Patent or IP Counsel and CEA, respectively. This release category does not remove Export Control restrictions, including release restrictions for software classified as ITAR or EAR with an ECCN number.
3.2.5 Approved for U.S. Government Purpose Release.
3.2.5.1 Types of U.S. Government Purpose Releases:
a. Approved for Beta Release.
b. Approved for Project Release.
c. Approved for Developmental Release.
d. Approved for Interagency Release.
e. Approved for Intra-NASA Release.
3.2.5.2 Except for (1) a civil servant-to-civil servant exchange of software within NASA or (2) software released as Government-Furnished Computer Software and Related Technical Data under a NASA contract, an SUA is required for all subcategories under the Approved for U.S. Government Purpose Release.
a. Once a release of a particular software to a NASA project other than the project that has responsibility for that software has been approved and released via an SUA, that software may be further released civil servant-to-civil servant within that project without further review.
b. Nondisclosure and export control provisions will be included in SUAs as directed by the designated Patent or IP Counsel and CEA, respectively.
c. Permission to redistribute NASA software to contractors and/or subcontractors for use under a Government contract may be included in the SUA.
3.2.5.3 Approved for Beta Release. A Beta Release is only appropriate for the purpose of obtaining test and evaluation comments and feedback on the operation of a NASA- developed computer program from beta release recipients. A Beta Release to a foreign organization, will be authorized by the SRA only after consultation with and concurrence by the CEA.
3.2.5.4 Approved for Project Release. The SRA shall authorize a Project Release only in support of work deemed to be a Government purpose, as set forth below:
(1) For use under U.S. Government contracts.
(2) For use under a qualifying Space Act agreement, cooperative project, exchange program, or other agreement in which the U.S. Government is a party.
(3) For use by a foreign organization if determined by NASA to be required to implement an international cooperative project established by the U.S. Government in an international agreement with the foreign cooperating or sponsoring agency.
a. Nondisclosure and export control provisions should be included as directed by the Patent or IP Counsel and CEA, respectively. At a minimum, NASA will obtain Government purpose license rights to any software enhancements or derivative works made by the software recipient.
b. Project Release for use under U.S. Government contracts. The release will specifically limit the use of the software to the contractor and authorized subcontractors. Upon approval by the SRA, the release may be implemented by the responsible technical project monitor and may be made before the Technology Transfer Assessment is completed.
(1) If released as Government-Furnished Computer Software under a contract, use of the software will be limited to accomplishing work under that contract and the contract shall contain the 48 CFR subpts. 1852.227-88, Government-Furnished Computer Software and Related Technical Data clause.
(2) If released under a separate SUA, use of the software will be limited to accomplishing work under the contract(s) listed in the SUA.
c. Project Release in the United States for use under a qualifying U.S. Government purpose Space Act Agreement, cooperative project, exchange program, or other agreement between the U.S. Government and another organization. The release will be specifically limited to the use of the software by the stated recipient, solely to accomplish the U.S. Government purpose work described in the agreement, or if further distribution is approved, delineated in any U.S. Government-approved distribution of the released software.
d. Project Release for use by a foreign organization to implement an international cooperative project established by NASA in a project agreement with the foreign cooperating or sponsoring agency. The release will be specifically limited to use of the software by the stated recipient and should prohibit any further distribution.
(1) Any such release will be in accordance with the international agreement and the NASA Export Control Program determination.
3.2.5.5 Approved for Developmental Release. This category is generally a type of Project Release for use under a NASA contract where Software Product Baseline is released specifically for further development on behalf of the Government, but not including operational use.
3.2.5.6 Approved for Interagency Release. This type of release is for use by another U.S. Government agency and will include any use restriction (e.g., for governmental purposes only or for internal Government use only) associated with the software. If the receiving Agency is authorized to further release the software, provisions to flow down disclaimer and indemnification provisions to the further recipients are required.
3.2.5.7 Approved for Intra-NASA Release. In a Civil Servant to Civil Servant release of software, compliance with the software reuse provisions of NPR 7150.2 is required. If the receiving Center plans on releasing it to a Center contractor, the receiving Center shall use a Project Release under paragraph 3.2.5.4.b.
3.2.5.8 The SRA shall not authorize an Unrestricted Release (as defined in Appendix A).
3.2.5.9 Patent and Copyright Licensing. Patent and copyright licensing is implemented under NPD 2090.6, Authority to Enter Into License Agreements and Implementation of Licensing Authority. However, NPD 2090.6 does not authorize release of the licensed software. Before software is released to a licensee, NASA shall complete the same review and assessment process as described in this NPR.
3.3.1 All software released by NASA, except for an Approved for NASA Release, will contain appropriate disclaimer and indemnification provisions stating that the software is provided "as is" without any warranty, expressed or implied and that the recipient waives any claims against, and indemnifies and holds harmless, the Government and its contractors and subcontractors.
3.3.1.1 The disclaimer and indemnification provisions should be included in the SUA and, where practicable, will be displayed on software startup and/or, for software delivered in tangible form, be attached as a label to the software medium released.
3.3.1.2 Use of any exceptions to the disclaimer and indemnification clauses will be approved by the Center Office of the General Counsel or Patent or IP Counsel. With the approval of counsel, reference to indemnification may be removed when:
(1) A Recipient is a state government entity (e.g., a state college/university) or U.S. Government entity prohibited by state or Federal law from agreeing to indemnify;
(2) NASA software is distributed with, or as part of, external Open-Source Software obtained by NASA under a license that does not include indemnification provisions and that requires all software distributed with that external Open-Source Software to be distributed under the same license terms; or
(3) In the case of a Project Release under a Government contract, the software is provided as Government-Furnished Information (GFI) under the contract or as otherwise approved by the Center Office of the General Counsel or Center Patent or IP Counsel.
3.4.1 Copyright and restrictive notices will be included in the SUA.
3.4.1.1 Where practicable, copyright and restrictive notices will be embedded in the software, displayed on software startup, and/or be attached as a label to the software medium released.
3.4.1.2 Copyright Notice. Software released by NASA will normally include a copyright notice.
a. For purposes of the year of first publication used in the copyright notices below, publication means the first distribution of software to an entity external to NASA as a Public Release or Open-Source Release. If software has only been released under one of the more restrictive release categories that do not allow further release, it is not considered to be published and only an unpublished work copyright notice will be used. If a particular software version includes all or parts of earlier versions that have been released at different times, the year of first publication may include multiple years or a range of years that correspond to the various releases (e.g., Copyright 2010 or 2012-2014).
b. The SRA shall consult with the Center Patent or IP Counsel to determine if a copyright notice is required and, if so, the proper copyright notice to include in the software or SUA.
c. In the event NASA has been granted the right to release software owned by third parties (e.g., through written permission or license from the software owner), any third-party copyright notices on such software will be included in the SUA or in a readme file within the software (e.g., as is the practice in Open-Source Releases). 3.4.1.3 Restrictive Notice.
a. The following general restrictive notice should be included in the SUA for all releases except for an Approved for NASA Release: This software may be used, reproduced, and provided to others only as permitted under the terms of the contract or other agreement under which it was acquired from the U.S. Government. Neither title to, nor ownership of, the software is hereby transferred. This Notice shall remain on all copies of the software.
b. Any specific use and disclosure restrictions will also be specified in the SUA.
3.5.1 Software Release Records. The SRA shall ensure all required Software Release Records are stored in NTTS. The release of NASA software without an appropriate SUA or release record is prohibited.
3.5.1.1 Software and Software Release Records will be safeguarded, retained, and disposed of per guidance provided in NPR 1441.1.
3.5.1.2 NTTS shall be used to record and maintain metrics data.
| TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | ALL | |
| | NODIS Library | Legal Policies(2000s) | Search | |
This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.