Federal Cooperative Agreement Summary

Award Details: The National Science Foundation (NSF) awarded a $1.5M Cooperative Agreement under the Technology, Innovation, and Partnerships (TIP) program (CFDA 47.084) to The Regents of the University of Colorado, effective October 1, 2025, through September 30, 2027. The project, titled "NSF SAFE-OSE: Enhancing Safety, Security, and Privacy in the Community Earth System Model (CESM) Ecosystem," is performed in Boulder, Colorado.

Products and Services: The award funds development and implementation of a comprehensive security framework for the Community Earth System Model (CESM), a critical open-source tool used for Earth systems simulation and prediction of natural disasters. The awardee will refactor the CESM codebase to support modern security practices, including decoupling computational and control logic and rewriting the control layer in Python. The project delivers three clusters of automated security techniques: static analysis using query engines and large language models; dynamic testing via targeted unit and regression tests; and supply chain security techniques for detecting vulnerable dependencies. These security enhancements will be integrated into an upgraded continuous integration and continuous delivery pipeline. Additionally, the project implements a maintainer vetting process and provides community-focused security training to address socio-technical risks and ensure long-term sustainability. The effort is designed to serve as a model for enhancing security practices across other scientific software ecosystems used in disaster response, agriculture, energy planning, public health, and national defense.