Attachment 2_Instructions for Completing the Software Telemetry Disclosure Form.docx

Instructions for Completing the Software Telemetry Disclosure Form Purpose of the Form:

This form is a mandatory disclosure document required to ensure compliance with Department of Defense (DoD) cybersecurity standards. Its purpose is to transparently document any and all "phone-home," telemetry, or external callback features within the software. This information is critical for assessing the software's suitability for deployment in secure, disconnected, or air-gapped government networks.

Please fill out Part I of the form completely and accurately. Part II is for internal DoD review and should be left blank by the vendor.

Part I: VENDOR DISCLOSURE

1. Software and Vendor Information This section collects basic identification details.

· Vendor / Company Name: Provide the full, official name of your company.

· Software Name & Version: State the specific name and version of the software being provided (e.g., "Product X v2.1.3").

· Delivery Method: Describe how the software is delivered (e.g., Electronic Download, SaaS, Container Image, Physical Media).

· Vendor Point of Contact: Provide the name, direct telephone number, and email address of a technical representative who can answer detailed questions about the software's functionality and the information provided in this form.

2. Telemetry, Analytics, and External Callback Behavior This section is the core of the disclosure. You must detail every feature within the software that initiates an outbound connection to an external network.

· If your software makes no external connections of any kind, write "None" in the first row under "Feature / Process Name" and leave the rest of the table blank.

· If your software does make external connections, you must create a separate entry for each one. For each connection, provide the following details:

· Feature / Process Name: Identify the specific software feature or background process that makes the connection (e.g., "Automatic Update Check," "License Verification," "Crash Reporting").

· Purpose of Connection: Briefly explain why this connection is necessary (e.g., "To check for new software versions," "To validate license status").

· Destination (URL / IP): List the exact destination URL or IP address the software connects to.

· Protocol & Port: Specify the network protocol and port number used (e.g., "HTTPS/443," "TCP/8080").

· Data Transmitted: Describe the type of data that is sent from the system to the external destination (e.g., "License key and system ID," "Anonymized usage statistics," "Error logs").

3. Air-Gapped Deployment & Disablement Configuration This section assesses the software's ability to function in an environment with no internet access.

· Requirement Questions: Answer the four "Yes / No / N/A" questions regarding the software's behavior when disconnected from the internet. These are crucial for understanding its capabilities in isolated environments.

· Disablement Instructions: If you listed any external callbacks in Section 2, you must provide clear, step-by-step instructions on how to permanently disable them.

· Configuration Action / Command: List the specific commands, configuration file modifications, or environment variables required. Be precise. For example: Set 'TELEMETRY_ENABLED=false' in config.ini or Run setup.exe --disable-updates.

· Expected Result: Describe what the administrator should see or how they can verify that the action was successful (e.g., "The software no longer attempts to connect to updates.vendor.com").

4. Vendor Certification An authorized technical representative from your organization must sign and date the form.

· Role: The person signing should be a Technical Lead, Engineer, Security Officer, or other executive with the authority and technical knowledge to attest to the accuracy of the information provided.

· Name & Signature: The printed name and signature of the representative.

· Date: The date of signing.

By signing, the vendor certifies that all information is complete, accurate, and that no undocumented external connections exist in the software.

To ensure a smooth procurement and deployment process, please be as thorough and transparent as possible when completing this document.