Attachment 1_Software Telemetry Disclosure Certification.pdf

Software Telemetry and Phone-Home Disclosure Authority:

This disclosure supports compliance with DoDI 8500.01 (Cybersecurity) and DoDI 8510.01 (Risk Management Framework (RMF)), enforcing baseline controls from NIST SP 800-53 (Rev. 5) (e.g., SC-7, CM-6, SI-4). It ensures no unauthorized data exfiltration occurs and verifies readiness for secure, disconnected, or air-gapped networks.

PART I: VENDOR DISCLOSURE

(To be completed by the Software Vendor or Provider)

1. Software and Vendor Information

Vendor / Company Name

Software Name & Version

Delivery Method

Vendor Point of Contact

2. Telemetry, Analytics, and External Callback Behavior

Disclose any features within the software that initiate outbound connections to external networks, vendor servers, or third-party analytic services (e.g., usage tracking, crash reporting, license verification, automated updates). If none, state "None" in the first row.

Feature / Process Name

Purpose of Connection

Destination (URL /

IP)

Protocol & Port

Data Transmitted

Name, Telephone, Email

Yes / No / N/ARequirement

Can all telemetry, analytics, and phone-home features be permanently disabled?

Will the software retain 100% of its core functional capabilities if disconnected from the internet?

Does the software require an internet connection for initial deployment, installation, or bootstrapping?

Does the software utilize hardcoded IP addresses or DNS names that cannot be modified?

3. Disablement Instructions

Provide the specific configuration steps, environment variables, command-line flags, or configuration file modifications required to disable all telemetry and external connections.

Step # Configuration Action / Command Expected Result

Name & Signature Date

Role Technical Lead / Engineer Security Officer / Exec

4. Vendor Certification

By signing below, the vendor attests that the information provided in Part I is complete and accurate, and that no undocumented external callbacks or data exfiltration mechanisms exist within the provided software package.

3. Air-Gapped Deployment & Disablement Configuration

For DoD environments operating without external internet access, all external callbacks and telemetry must be disabled to prevent anomalous traffic and security alerts.

PART II: DoD INTERNAL REVIEW & INTAKE

CERTIFICATION

(To be completed by DoD / DoW Personnel prior to deployment)

5. Technical Deployment Confirmation

The Technical Point of Contact (POC) must verify the target environment and confirm that vendor-provided disablement instructions are compatible with the deployment architecture.

Intended Deployment Enclave Target System / Program Name Telemetry Disablement Tested?

Technical POC (Name & Rank/ Title) Technical POC Signature & Date

6. Cybersecurity Intake & Scan Validation

The Cybersecurity Point of Contact (POC) / Information Systems Security Officer (ISSO) must confirm that the software package, container, or imagery has undergone required intake scanning (e.g., malware, container vulnerability, static analysis) and is cleared for deployment within the stated environment.

Scan Type / Activity Tool Used (e.g., ACAS, Twistlock, SonarQube)

Date Performed

Status / Result (Cleared, Mitigated, POA&M)

Details

Malware / Antivirus Scan Vulnerability / Container Scan Static Code Analysis (If applicable)

Field Cybersecurity POC Name

Approval Status

Cybersecurity POC Signature & Date

Note for Procurement/Cyber Teams: This document must be retained as an artifact within the system's RMF authorization package to validate baseline configuration and boundary protection compliance.

4. Vendor Certification