Att 06 STE-IS SDA.pdf

UNCLASSIFIED

UNCLASSIFIED//Distribution A. Approved for public release: distribution unlimited. Upon completion and submission, document becomes

Distribution C CONTROLLED UNCLASSIFIED INFORMATION. Last updated 20210517.

SYNTHETIC TRAINING ENVIRONMENT - INFORMATION SYSTEMS (STE-IS)

SOFTWARE DISTRIBUTION AGREEMENT

(For United States Government and USG Contractors)

DISTRIBUTION STATEMENT- The STE-IS software and associated materials

(together herein, “STE-IS Software”) is authorized for distribution in accordance with CUI//SP-CTI, EXPT//Distribution Statement C:

Distribution authorized to U.S. Government agencies and their contractors

(ADMINISTRATIVE OR OPERATIONAL USE, March 4, 2021). OTHER REQUESTS SHALL BE REFERRED TO THE U.S. ARMY

CAPABILITY PROGRAM EXECUTIVE SIMULATION, TRAINING, TEST, AND THREAT (CPE ST3), PROJECT MANAGER

FOR COMMON SYNTHETIC ENVIRONMENT (PDM CSE), TSS/TMT PROGRAM.

WARNING This Agreement refers to technical data, the export of which is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, and et seq.) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., and App. 2401 et seq. Violations of these export laws are subject to severe criminal penalties. Disseminate STE-IS software in accordance with provisions of DoD Directive

5230.25.

SUBJECT TO APPROVAL BY A GOVERNMENT SPONSOR, THE STE-IS SOFTWARE MAY BE USED FOR THE PURPOSE

STATED WITH THE FOLLOWING TERMS AND CONDITIONS:

• The STE-IS is Controlled Unclassified Information (CUI) Export Control under ITAR 22CFR ch1 (4-1-13 Ed) 121.8, and shall be handled and maintained in accordance with DoD 5220.22M -NISPOM, AR 380-5 Information Security Program.

• The STE-IS software will be used only in accordance with this Distribution Agreement. The purpose may include incorporating the

STE-IS software, or elements thereof, into products being developed under the terms of a current contract with the U.S.

Government. The STE-IS software will not be modified, adapted, or otherwise altered except as required for the stated purpose.

• STE-IS software may be distributed with products from other USG agencies. Additional restrictions may apply to software not owned or controlled by PdM Common Synthetic Environment (CSE), Training Simulation Software/Training Management Tool

(TSS/TMT) Program (see documentation provided with the software).

• STE-IS software shall not be re-distributed, sold, or used for commercial or personal purposes by Recipient, in whole or in part, without the express permission of the CPE ST3, PdM CSE program office except as set forth herein. The recipient is prohibited from using TSS/TMT open-source code for commercial or personal practices and profitable gains. Recipient may copy Attachment 8a, TSS/TMT Software, for use within the recipient’s organization, or by an authorized U.S. contractor/sub- contractor organization, for the Purpose stated within this Agreement. A copy of this Agreement shall be provided and maintained with each authorized copy of the TSS/ TMT Software and appropriate personnel shall be briefed regarding the Agreement requirements. PdM CSE, TSS/TMT is to be formally notified of the name, address and designated POC of all authorized U.S. contractors/sub-contractors to which a copy is provided. Recipient shall be responsible for compliance with this Agreement related to all authorized copies.

• Changes to the STE-IS software source code may not be further distributed by the recipient without the approval of the controlling

DoD office. Recipients wishing to distribute changes, which they have developed, may submit such changes to the controlling DoD office with Unlimited Rights.

• Recipient will ensure that its sub-contractors will, return or destroy all STE-IS software data and access upon completion of the approved work, or completion of the contract under which the work is authorized, whichever comes first.

• This STE-IS software is developmental in nature. The U.S. Government and its agents shall not be liable for any harm, damage, or injury that may result from the use of the STE-IS software.

• The controlling DoD office may revoke permission or hereinafter make permission subject to additional conditions as dictated by

Government interests.

• The individual who will act as recipient of the STE-IS software is a U.S. citizen.

• Recipient acknowledges its responsibilities under the U.S. export control laws and regulations and agrees that it will not disseminate any export-controlled material subject to this Agreement in a manner that would violate applicable export control laws and regulations.

• The STE-IS software shall not be released or provided to any USG contractor who is Foreign Owned, Controlled or Influenced

(FOCI) unless a copy of the State Department documentation (SF328 and D-2032) authorizing approval to work on DoD

Government contract and if required a copy of the Technical Assistance Agreement (TAA) provided as well for review as per

DODM 5220.22M – NISPOM, AR 380-49 – Industrial Security.

unlimited. Upon completion and submission, document becomes

Distribution C CONTROLLED UNCLASSIFIED INFORMATION. Last updated 20210517.

• The STE-IS software or source code shall not be posted on any public facing websites.

• The STE-IS software shall not be sold, released, provided or demonstrated to any Foreign National, or Foreign

Representative without prior foreign disclosure approval from the CPE ST3 G2, FDO per AR 5-11 – Management of Army

Modeling and Simulation and AR 380-10 – Foreign Disclosure and Contract with Foreign Representatives.

• Unless dissemination is permitted herein and by applicable regulations, Recipient will not provide access to the STE-IS software other than to its employees or persons acting on its behalf without permission of the controlling DoD office.

• Recipient is not debarred, suspended or otherwise determined ineligible by any agency of the U.S. Government to perform on U.S.

Government contracts, has not been convicted of export control law violations, and has not been disqualified under the provisions of DoD Directive 5230.25.

• Recipient may not distribute changes to the STE-IS software source code except as set forth herein without the approval of PdM

CSE, STE-IS. Recipient may incorporate STE-IS software, or elements thereof, into products developed by Recipient and its sub-contractors. As consideration for the Government providing the STE-IS software, Recipient will provide PdM CSE, STE-IS Unlimited

Rights, per DFARS 252.227-7014, to the modified software. The approved Recipient agrees to provide to the controlling DOD office, without further Government request, any and all changes, enhancements, improvements or modifications which may be made to the STE-IS software while in the approved Recipient's possession. Personally Identifiable Information (PII) should not be included in the software baseline. If PII is found, it will be removed by PdM CSE, STE- IS. If PdM CSE, STE-IS does not receive the enhancements, improvements or modifications made to STE-IS software with Unlimited Rights, PdM CSE, STE-IS may demand the return and/or destruction of the STE-IS software in Recipient's possession. A failure to return and/or destroy the STE-IS software will be deemed a breach of this agreement and may result in prosecution of the USG’s rights in the applicable forum. The following items include, but are not limited to, changes to the STE-IS software code:

a. Creation of new entities, units, or behaviors

b. Any modification of existing entities, units, or behaviors

c. The modification of existing code

d. The creation of new physical models

Does the Recipient intend to make changes to the source code provided by PdM CSE TSS/TMT

Program, as described above?

If yes, please provide a description of modifications and projected completion date:

Description:

Projected completion date:

• The STE-IS software application is currently maintained in accordance with the DoD Risk Management Framework

(RMF). The Recipient must agree and adhere to all applicable Cybersecurity RMF related policies, procedures, controls and limitations for the infrastructure environment or system in which the STE-IS software will be installed. The Recipient agrees to install the STE-IS software in an operating system compliant with applicable DISA Security Technical

Implementation Guides. Recipient of the software application has the responsibility for ensuring Compliance, or receive local AO Risk Acceptance, for the following RMF controls, which have been designated Site/User responsibilities provided cybersecurity controls:

RMF Description

AC-2 The Recipient shall implement an access control policy that establishes the rules for the creation, modification, disabling, and removing information system accounts.

AC-2 The Recipient monitors the use of information system accounts.

AC-2 The Recipient authorizes access to the information system based on a valid access authorization, and intended system usage

AC-2 (4) The Recipient, on the information system automatically audits account creation, modification, enabling, disabling, and removal actions, and provides notification unlimited. Upon completion and submission, document becomes

Distribution C CONTROLLED UNCLASSIFIED INFORMATION. Last updated 20210517.

RMF Description

AC-2 (10) The information system terminates shared/group account credentials when members leave the group.

AC-3 The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

AU-5 The information system takes organization defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).

CM-5 The Recipient defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.

SI-2 The Recipient installs security-relevant software or firmware updates provided by the STE Program Office within

30 days of receipt.

SI-4 The organization monitors the information system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.

SI-6 The information system performs verification of the correct operation of organization-defined security functions:

when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.

SI-6 The information system notifies organization-defined personnel or roles of failed security verification tests.

In the event of a suspected security incident, technical staff will immediately notify their designated ISSO/ISSM, who shall notify the CPE ST3 / PdM CSE ISSM by telephone or e-mail (POC: Jeffrey Ketts, (O) 520-692-7670, jeffrey.l.ketts.civ@army.mil) when a security incident(s) is detected that has potentially affected the system hosting the STE-

IS software application, so the other party may take steps to determine whether its system has been compromised and to take appropriate security precautions. The Recipient shall notify the CPE ST3 application owner POC (MAJ Robert Scrip, robert.j.scrip.mil@army.mil) in writing, within five (5) business days after detection of the incident(s).

Any security vulnerabilities detected with the STE-IS software will be reported by the user to CPE ST3 PdM CSE ISSM.

Recipient hereby waives any and all claims for damages under any U.S. Government contract for alleged Government caused delay occasioned by revocation of the right to use STE-IS software.

STE-IS version/product(s), component(s) or configuration baseline(s) being requested:

The STE-IS software is transferring to: DoD, DoD Contractors, and US Government Agencies Foreign Nationals or Foreign Representatives

Install media type required:

Estimated project completion date:

PURPOSE: Clearly identify the intended purpose/use of the STE-IS software plus impact of not receiving material.

Contractor requests are to include pertinent section(s) of the contractual Work Statement or the

Request for Proposal that requires the STE-IS software activity.

Simulation Community(ies) Supported:

Acquisition Analysis Experimentation

Intelligence Test and Evaluation Training mailto:carmen.g.colon2.civ@army.mil mailto:rodney.r.figaroa.civ@army.mil unlimited. Upon completion and submission, document becomes

Distribution C CONTROLLED UNCLASSIFIED INFORMATION. Last updated 20210517.

X

Army Cross Functional Teams (CFTs) Supported:

Long Range Precision Fires (LRPF)

Future Vertical Lift (FVL)

Precision Navigation Timing (PNT)

Soldier Lethality (SL)

Next Generation Combat Vehicle (NGCV)

Air & Missile Defense (AMD)

Synthetic Training Environment (STE)

Network, Command, Control, Communications, and Intelligence

(NC3I)

Other service priority - Provide service and focus of effort:

Requesting Company/Organization:

Contact Name:

Job Title:

E-mail:

Address 1: _

Address 2:

City: Country/State: Postal/Zip code: - Phone no: ext./DSN:

I HEREBY AGREE TO CONDITIONS 1-16 IDENTIFIED ON PAGES 1, 2, AND 3 OF THIS DOCUMENT AND WILL

UTILIZE THE STE-IS SOFTWARE ONLY FOR THE PURPOSE/USE DESCRIBED ABOVE. I UNDERSTAND THAT

PROCESSING OR TRANSMITTING THIS EXPORT CONTROLLED MATERIAL VIA ANY PUBLIC ELECTRONIC

MEDIUM IS STRICTLY PROHIBITED.

Signature:

unlimited. Upon completion and submission, document becomes

Distribution C CONTROLLED UNCLASSIFIED INFORMATION. Last updated 20210517.

U.S. GOVERNMENT DOD CONTROLLING OFFICE ENDORCEMENT/APPROVAL

(This section is for internal STE-IS use only.)

The above request is approved for the purpose stated by the requester.

Technical Review (Required for any pre-release requests of the STE-IS software):

Name:

Job Title:

Telephone: _ DSN:

E-mail:

Authorized Signature:

Release Approval:

Name:

Job Title:

Telephone: DSN:

E-mail:

Authorized Signature:

REQUIRED FOR AUTHORIZED USG CONTRACTOR REQUESTS

(To Be Completed by USG Sponsoring Organization COTR or other authorized individual.)

Verify or attach a copy of the pertinent section(s) of the Statement of Work (SOW), Performance Work Statement

(PWS), Request for Proposal (RFP), or Call for Solutions (CFS) which supports the STE-IS software as a supplement to this form.

USG Sponsor (Organization):

USG Contract Number: _ Contract Completion Date:

It is requested that the STE-IS software material be released to the above-identified contractor for the purpose as stated. It is hereby certified that the contract number and completion date identified above are correct and the identified contractor requires the STE-IS software Configuration material for the purpose stated.

Name: _

Job Title: _

Telephone: _ DSN: _

E-mail: _

Authorized Signature: _