(U) NGAI 8410.2_Software Asset Mgmt_Update_4.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency

INSTRUCTION

NUMBER 8410.2

02 June 2017

Administrative Update 4: 12 July 2019

CIO-T

SUBJECT: Software Asset Management

References: See Enclosure 1.

1. PURPOSE. This Instruction:

a. Establishes policy, assigns responsibilities, and provides procedures for the procurement and management of all NGA software in accordance with (IAW) References (a) through (d) and (f) through (r s) to improve and streamline software lifecycle processes (selection, allocation, consolidation, delivery, operations and maintenance, and disposition) and to gain efficiencies while meeting user requirements.

b. Establishes standards of conduct with respect to software procurement, copying, transfer, and use.

2. APPLICABILITY. This Instruction applies to:

a. All NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors, hereinafter referred to as personnel, at all locations in the Continental United States (CONUS) and Outside the Continental United States (OCONUS) who procure and manage software on behalf of NGA.

b. All NGA systems, networks, and devices.

c. Government off-the-shelf (GOTS), commercial off-the-shelf (COTS), and externally developed software procured by or on behalf of the NGA.

3. DEFINITIONS. See Glossary.

4. POLICY. It is NGA policy that:

a. All software procurement and management to include software for Research and Development (R&D) adheres to all procedures and standards.

NGAI 8410.2

b. Software deployments to the NGA Information Technology (IT) enterprise comply with the contractual terms and conditions as negotiated between vendors and NGA within License Agreements IAW Reference (l).

c. Personnel cannot use unauthorized software on NGA systems, networks and devices.

d. NGA-procured software cannot be used on unauthorized systems, networks and devices except as approved for telework IAW Reference (q).

e. Personnel cannot make unauthorized copies of NGA procured software.

f. Software is maintained at the latest version and patch level approved on NGA’s Software Whitelist Assurance Process (SWAP).

5. RESPONSIBILITIES. See Enclosure 2.

6. PROCEDURES. See Enclosure 3.

7. EFFECTIVE DATE. This Instruction is effective on the date of signature.

Tanya Pemberton Chief Information Officer

Enclosures

1. References

2. Responsibilities

3. Procedures

Glossary

CHANGE LOG

Change Type

Change Date

Revised By

Pages Affected

Change Description

A

10/05/17 2, 5, 6, 7, 9, 14

Updated to address merger of “Software Approval Process (SWAP)” and “Software Whitelist” into Software Whitelist Assurance Process

(SWAP).”

S

10/05/17 4, ,8, 12

Added references, responsibilities, and procedures for handling software identified as a record in accordance with added policy references

A 10/05/17 9 Paragraph 1.e. expanded to make 2 subparagraphs for clarification.

S 10/05/17 13 Added definition for foreign ownership, control and influence

(FOCI).

A 09/24/18 1, 11 Deleted reference (s), changed to (r)

A 7/12/19 1, 4, 7, 11 Corrected Reference list and updated references within policy.

ENCLOSURE 1

REFERENCES

(a) National Archives and Records Administration, “The General Records Schedules, Transmittal 27,” January 2017

(b) General Services Administration (GSA) Section 508 Program, “Guidance on Creating 508 Compliant IT Solutions,” 21 September 2015

(c) GSA Section 508.gov, “Vendor Accessibility Information,” www.Section508.gov/content/sell/vpat

(d) Federal Acquisition Regulations System, Part 2, “Definitions of Words and Terms,” 15 August 2016

(e) Department of Defense (DoD) Defense Acquisition University, “Defense Acquisition Acronyms and Terms, 15th Edition,” December 2012

(f) DoD 7000.14-R, “Financial Management Regulation,” Volume 4, Chapter 6, “Property, Plant, and Equipment,” June 2009

(g) NGA Directive (NGAD) 1455.1, “Disciplinary and Adverse Actions,” 26 August 2013

(h) NGAD 3330, “Program Protection Planning,” 19 May 2015

(i) NGAD 5505, “Suspension and Debarment of Contractors,” 06 April 2015

(j) NGAD 7410, “Inspector General Operations,” 02 June 2014

(k) NGAD 8000, “Information Management and the Chief Information Officer,” 12 June

(l) NGA Instruction (NGAI) 5100.1, “NGA Acquisition Regulation Implementation

(NARI),” 13 July 2016 (m)NGAI 7050.5, “Coordination of Remedies for Fraud and Corruption Related to

Procurement Activities,” 05 August 2015

(n) NGAI 7260.1, “Cost Accumulation Framework,” 20 April 2016

(o) NGAI 8040.2, Volume 1, “Records and Information Lifecycle Management: Records

Management Program”, 30 March 2016

(p) NGAI 8400.4, “Implementation of Electronic and Information Technology

Accessibility/Section 508 Program,” 05 July 2017

(q) NGA Manual (NGAM) 1060.1, “Telework Request and Implementation Process,” 16

December 2014

(r) NGAM 7210.2, “Administrative Control of Appropriated Funds and Antideficiency Act

(ADA) Violations,” 01 October 2014

(s) NGAM 7410.11, “Inspector General Operations,” 02 June 2014

ENCLOSURE 2

RESPONSIBILITIES

1. Chief Information Officer (CIO).

a. Designates Software Asset Management Office (TCS) to serve as the Agency's single focal point for approval of all software to be procured and the single focal point for the management of all software assets (except as noted in paragraph 4) across NGA’s operational and developmental enterprise baselines as instructed in Reference (l).

b. Ensures NGA compliance with Section 508 of the Rehabilitation Act of 1973.

(References (b) and (p)).

c. Ensures that TCS monitors, reviews, and analyzes NGA systems, networks, and devices for non-compliance with software procurement activities and refers non-compliant parties for enforcement actions.

d. Determines acceptable risk for software use (open source, freeware, shareware, COTS, GOTS, and foreign) on NGA systems, networks and devices.

e. Ensures that TCS reports software procurements that meet the criteria for an Internal Use Software capital asset IAW Reference (e) to the NGA Total Asset Management (TAM) office and Financial Management (FM) Property and Reporting office as required.

2. Director, IT Services (D/IT).

a. Plans, aligns, and executes the D/IT software budget IAW References (d), (f), (l), and (n).

b. Maintains and manages the SWAP which contains approved applications for use within NGA’s Operational Enterprise. The SWAP is located at http://swap.nga.ic.gov/ng/#/app/swap/product/current.

c. Coordinates the monitoring of all NGA systems, networks and devices for unauthorized software installation and usage.

d. Evaluates all NGA software to be procured to ensure compliance and enforcement with all security mandates, directives, and other issuances.

e. Ensures the effective and efficient management of all NGA IT assets and resources, e.g., equipment, funding, and personnel.

3. Director, Software Asset Management (D/TCS).

a. Maintain cognizance of all terms, conditions and restrictions governing NGA’s use and disposition of commercial software assets within the Enterprise and monitor agency use of the products to ensure compliance with applicable terms.

b. Approves all software to be procured by Director, Office of Contract Services (D/OCS) and manages all software assets (except as noted in paragraph 4) across NGA’s operational and developmental enterprise baselines as instructed in Reference (l).

c. Addresses both internal and external software audit requests, supported by NGA IT service organizational elements.

d. Manages and streamlines NGA’s software life cycle processes.

e. Ensures all software procured for installation on NGA’s IT systems, networks and devices is limited to those products that are on the SWAP.

f. Ensures that all software is procured with a current maintenance contract and is maintained at the latest version and patch level listed on the SWAP.

g. Ensures all software procured for installation on NGA’s IT systems, networks and devices is compliant with the provisions of References (l), (m), and (p).

h. Ensures that software licenses are reconciled to original invoices to include upgrades from previous software versions to a sufficient level to satisfy an independent audit as mandated by Reference (l).

i. Refers all allegations of software acquisition fraud and corruption to the D/OCS and the Office of Inspector General (OIG) IAW Reference (j).

j. Uses and maintains the Agency’s software requirements tool to enable the capture of software requirement details and costs.

k. Coordinates with the Application Service Provider(s) (ASP), Infrastructure Service Provider(s) (ISP), and Program Managers (PMs), to ensure that licenses are used only IAW the terms and conditions of use.

4. Director, Research (D/R).

a. Approves all software to be procured and installed on R systems, networks and

b. Designates in writing the individuals authorized to approve software procurements for installation on R systems, networks, and devices.

c. Ensures all software procurements for installation on R systems, networks and devices are compliant with the provisions of Reference (l).

d. Monitors R systems, networks and devices and refers all issues of non-compliance to OCS and OIG IAW Reference (m).

5. General Counsel (GC). Executes authorities as the NGA Suspension and Debarment Official IAW Reference (i).

6. OIG.

a. Monitors and coordinates criminal, civil, administrative, and contractual remedies for significant fraud or corruption related to NGA software acquisition activities IAW Reference (m).

b. Monitors all investigations of alleged fraud and/or corruption related to NGA software acquisition activities and contracts.

c. Serves as the reviewing official and the presiding officer for NGA software acquisition false statements and false claims considered under the Program Fraud Civil Remedies Act as implemented in Reference (m).

d. Serves as the POC for criminal investigative organizations IAW Reference (r s).

7. D/OCS.

a. Acts as the responsible office for software procurement in NGA.

b. Designates, in writing, individuals with the authority to make software procurements.

c. Coordinates with GC and OIG to investigate fraud or corruption activities when necessary, or in certain situations IAW Reference (m).

8. Director, Security and Installations (D/SI).

a. Ensures SI collaborates with the CIO to protect the supply chain as it relates to the lifecycle of mission-critical products, materials, and services used by the Intelligence Community (IC) through the identification, assessment, and mitigation of threats IAW Reference (h).

b. Supports SWAP in ensuring SI conducts threat assessments of mission-critical software acquisitions for foreign ownership, control and influence (FOCI) and other counterintelligence threats IAW Reference (h).

9. ASPs and ISPs.

a. Ensure that no unauthorized software is installed on NGA systems, networks and

b. Ensure that personnel use only NGA-provided and IC Information Technology Environment (IC ITE) provided software.

c. Ensure that NGA-provided software is used only by authorized personnel.

d. In conjunction with D/TCS and D/R, ensure that licenses are used only IAW the terms and conditions of use.

10. Directorate Directors, Agency Element Leads (AEs), and PMs.

a. Provide all software and procurement documentation to TCS prior to decommissioning hardware assets. Will also provide documentation to TAM and FM

Property and Reporting office for any decommissioning of capital assets.

b. Review software requirements annually, and inform TCS of changes to software requirements prior to the annual billing timeframe.

c. Maintain responsibility for their software procurement and maintenance costs.

d. Identify their respective component focal point (CFP) for software requirements to

D/TCS.

e. Maintain and retire any software identified as a record IAW Reference (a) and (o).

ENCLOSURE 3

PROCEDURES

1. Pre-procurement request requirements.

a. The CIO, in coordination with D/SI, verify no FOCI issues are involved with the proposed vendor through the SWAP for all NGA operational, test and development, and R&D networks. The SWAP also includes SI threat assessments of mission-critical software acquisitions for FOCI and other counterintelligence threats.

(1) Requests to add software to the SWAP are processed by submitting a SWAP request located at http://swap.nga.ic.gov/ng/#/app/swap/splash/home.

(2) Requests to add software to the SWAP are processed by submitting request via the SWAP homepage (swap.nga.ic.gov/ng/#/app/swap/request/new).

b. Software approved for use on systems, networks and devices must be identified in the SWAP.

c. Software requests for use on development and test environments not hosted on NGA systems, networks, and devices must be listed on the SWAP.

d. Requests to procure software for development and test environments must include evidence of SWAP approval to be procured.

e. D/TCS may grant software procurement waivers by exception. This waiver enables a requestor to procure software without using TCS-maintained contract vehicles.

(1) The requestor submits the request with justification through the software request tool and, if approved by D/TCS, will receive the waiver within the tool.

(2) The requestor is required to complete a transfer spreadsheet noting the software items being purchased and authorizing transfer of maintenance back to TCS.

2. Software Procurement.

a. D/TCS provides access to a software request tool on the TCS homepage that allows personnel and organizations to request costed software listed in the NGA Software White List. TCS personnel assist users with this tool throughout the process.

Any procurement and maintenance costs incurred are the responsibility of the requesting organization.

b. Maintenance service contracts are required and purchased to ensure latest versions and all security patches are available to NGA.

c. The software request tool is used to arrange software requests, note budget lines of accounting, and coordinate approvals. Upon TCS verification of funding and approval, the request is prepared for acquisition. TCS begins the software ordering process in coordination with D/OCS, and it is reviewed by the GC.

d. In the event that NGA has additional quantities of the requested software available, the excess may be transferred between organizations. In these cases, TCS works with the requestor to facilitate the transfer using the Remedy Service Request Module (SRM).

e. D/OCS notifies TCS upon receipt of the software use rights and forwards any physical media it has received from the vendor to TCS.

f. D/TCS complies with Section 508 of the Rehabilitation Act of 1973 (References (b) and (p)) by:

(1) Verifying software compliance with vendor IAW Reference (p).

(2) Certifying software that fall within the scope of the National Security exception outlined in Reference (p).

(3) Maintaining an application’s Voluntary Product Accessibility Template on file for each approved software application used at NGA that does not meet the exemption requirements specified in Section 508 IAW Reference (b).

3. Software Provisioning.

a. Upon receipt of the media or access to digital files, TCS notifies the requestor to start a request in Remedy SRM to have the software provisioned. This provisioning is accomplished by CIO-T’s ASPs, ISPs, or PMs. In cases in which a PM handles the installation, the media and/or keys are provided directly to the PM.

b. TCS reviews all Remedy software provisioning requests for accuracy and completeness.

c. Desktop Self-Provisioning.

(1) On operational systems, networks, and devices, requestors may access the GEOINT Apps Store (GAS) capability through the Customer Service Portal. No-cost and some costed software is available in the GAS as well as widgets and apps. If the software is available, the requestor can select the required software which is then auto-provisioned to the requestor’s profile.

(2) Common Operating Environment (COE) requestors can request no-cost software using the Application and Service Catalog for the ENTerprise (ASCENT).

Costed software is requested using the TCS provided software requirements tool.

d. Components/AEs/PMs. Ensure prior to installation on NGA IT systems, networks, and devices, all software is scanned, code is secured, and compiled executables are not vulnerable to cyber security threats. A Security Impact Evaluation Request (SIDR) must be submitted and approved prior to any software being given authorization to deploy to any authorized NGA operational systems. Software on the SWAP list does not require a SIDR for installation on R&D systems unless it is a security relevant change.

4. Software Licensing Compliance. ISPs, TCS, and R share monitoring responsibilities using current NGA software asset management tools to verify:

a. No unauthorized software is used on NGA systems, networks, and devices.

b. Periodic reviews of deployed software are accomplished using a variety of tools across all the operational, test and development, and R&D environments.

c. Discrepancies are immediately adjudicated using established procedures to remove the software and check for any impacts.

d. These actions are presented by a formal report to the CIO documenting the policy violation. This includes inadvertent overprovisioning of software.

5. Software Audits.

a. Internal audits are performed throughout each year to reconcile inventory with invoices and maintain accurate inventories of current NGA software holdings.

b. The OIG may conduct audits, inspections, or other evaluations of the procurement and management of NGA software IAW References (j) and (r s).

c. External audits, requested by Congress, higher headquarters, and vendors will be addressed under a team comprised of OCS, GC, TCS, ASP, ISP, and/or program offices.

6. Software Asset Disposition.

a. TCS and R.

1) Identify software to be captured and re-provisioned from decommissioned systems.

2) Identify and document software that is to be retired from the NGA inventory.

3) Monitor departing NGA personnel to identify software for reuse.

4) Provide documentation to TAM and FM Property and Reporting office for any decommissioning of capital assets.

b. PMs. Coordinate with Records Management Office to retire software identified as records IAW Reference (a) and (o).

GLOSSARYGLOSSARY

Acquisition The conceptualization, initiation, design, development, testing, contracting, production, deployment, Logistical Support (LS), modification, and disposal of weapons and other systems, supplies, or services (including construction) to satisfy DoD needs intended for use in, or in support of, military missions.

(Reference (e))

Application Service Provider

(ASP)

Organizations providing computer-based services to customers over any network. (e.g., integration contractors). (Definition created by NGA for NGA Purposes Only)

Commercially available off-the-shelf (COTS)

A commercial item sold in substantial quantities in the commercial marketplace and offered to the government under a contract or subcontract at any tier, without modification, in the same form in which it was sold in the marketplace. (Reference (d))

Costed Software Software that has an associated cost for license and/or maintenance. Most software has the first year’s cost bundled in the initial purchase price. Maintenance cost in this case would be accrued by the purchasing Component or Portfolio beginning in year 2 of the contract period. (Definition created by NGA for NGA Purposes Only)

Foreign Ownership, Control, and Influence

(FOCI)

A U.S. company is considered under FOCI whenever a foreign interest has the power, direct or indirect, and whether or not exercised or whether or not exercisable through the ownership of the U.S. company’s securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company in a manner that may result in unauthorized access to classified information or may adversely affect the performance of classified contracts.

(Reference (g))

Government off-the-shelf (GOTS)

Government off-the-shelf refers to custom software developed for the government by either a government technical staff or an external entity with government funding, oversight, and specification. (Definition created by NGA for NGA Purposes Only)

Information Technology (IT)

Any equipment or interconnected system or subsystem of equipment used in the automated acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. IT includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources, including National Security Systems. It does not include any equipment acquired by a federal contractor incidental to a federal contract. (Reference (d))

Infrastructure Service Provider

(ISP)

An organization that provides IT infrastructure services.

(Definition created by NGA for NGA Purposes Only)

Internal Use Software (IUS)

Software that is purchased from COTS vendors or ready for use with little or no changes; developed by employees of DoD, including new software and existing or purchased software that is modified with or without a contractor’s assistance; contractor-developed software that DoD paid a contractor to design, program, install, and implement, including new software and the modification of existing or purchased software; and includes acquisition, finance, logistics, personnel or other business related systems. (Reference (f))

NGA Software White List

A listing of all software approved for installation and use on NGA IT networks. (Definition created by NGA for NGA Purposes Only)

Remedy/Service Request Module

(SRM)

NGA's web-based tool used to generate requests for IT services.

(Definition created by NGA for NGA Purposes Only)

Software Whitelist Assurance Process (SWAP)

An automated paperless enterprise process for submission and adjudication of NGA software requests. The SWAP process uses source-code analysis or research to identify whether software contains vulnerabilities or is foreign owned, controlled, or influenced. (Definition created by NGA for NGA Purposes Only)

Unauthorized Software

Software that has not been SWAP approved, thus not allowed to be installed on any NGA networks; software that is Illegally acquired or deployed. (Definition created by NGA for NGA Purposes Only)

Voluntary Product Accessibility Template

(VPAT)

A document that may be generated by a vendor to indicate a product’s conformance with the Section 508 accessibility standards. (Reference (c)) file:///C:/Users/lv20793/AppData/Local/Microsoft/Windows/Temporary%20Internet%20Files/Content.Outlook/AL4LWQ9S/Reference