Attachment B -NASA IT Software and Hardware Rider.pdf

80TECH26QA066

NASA IT Software and Hardware Rider

1. Audit and Compliance Review Notifications

All audit and compliance review notifications, to include anti-piracy violation inquiries, must be submitted via email to the Contracting Officer and Agency Software Manager. NASA will have 30 days to respond to all requests.

2. Use of Software with Automated Reporting Features

Automated reporting by a software firm with whom NASA maintains a licensing agreement must be encrypted through use of a VPN or over an authorized secure port to ensure information about NASA’s users and network is not exposed. Automated reporting from licensed software must not include personally identifiable information about NASA users. Automated reporting via unsecure means will not be allowed and such traffic will be blocked by NASA. NASA will not reconfigure security controls or firewall rules to accommodate automated software reporting. Automated report blocking by NASA will not constitute a violation of Publisher terms and all stated clauses to this effect are void.

3. Geographical Limitations

Use of the license(s) shall not be restricted to specific locations or time zones nor require additional license(s) for use within the US or US territory. License use may transfer to other NASA/government sites as required to perform required work. Publisher may request notification prior to license relocation.

4. License Usage

In performance of NASA business, license(s) may be used by Government personnel and Government contractors. No additional licensing requirements will be applied or enforced for contractor usage in performance of contracting duties or projects.

5. Contract Terms

Additional terms and conditions added to quotes and purchases will not be binding or act as a contract modification.

6. Reporting

Report requests for usage or entitlements must be submitted and approved by the contracting officer, prior to report generation. Reports will not be utilized to generate or compel compliance action(s).

Generated reports will not be shared with any 3rd party without prior consent by NASA. All requests to share data with 3rd parties must be submitted in writing and disclose identity of third party, all information to be shared, justification for sharing information, and data retention period. NASA may require additional information depending on security posture.

80TECH26QA066

7. Reserved

8. Artifacts (received from Dept of State)

The Contractor must regularly identify, assess, monitor, and mitigate cybersecurity supply chain risks when providing covered articles or services to the Government. The Contractor shall maintain artifacts (i.e., any byproduct of hardware or software development that helps describe the architecture, design, and function of that hardware or software) that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request, which may be redacted to remove sensitive proprietary information.

9. Price Sharing (received from OMB Memo M-16-12) NASA may share all prices, terms, and conditions for commercial and COTS software licenses with other Government entities, including posting said information to the Acquisition Gateway.

Terms or conditions that preclude NASA from sharing prices paid with other Federal agencies are prohibited.

10. License and Grants: At the time NASA places an order for PUBLISHER products, the contractor shall execute an order for a PUBLISHER EULA specifying the license grant details, including the license type, unit of measure, delivery location as requested by NASA, and the units ordered. The contractor acknowledges that NASA and its users shall not be bound by the terms of “Click Wrap” licenses or other related end user terms in the PUBLISHER EULA to the extent such “Click Wrap” licenses or end user terms conflict with the terms of this agreement.